GHSA-c8cc-hj57-vm65

User passwords transmitted in plain text by Jenkins Active Directory Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23105

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:active-directory	< 2.25.1	2.25.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23105 advisory
https://github.com/jenkinsci/active-directory-plugin/commit/07b05f83b167c79590f2efbdad8cb84fc98ed150 web
https://github.com/jenkinsci/active-directory-plugin package
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1389 web
http://www.openwall.com/lists/oss-security/2022/01/12/6 web