CVE-2020-2299

Name of the Vulnerable Software and Affected Versions Jenkins Active Directory Plugin versions 1.44 through 2.19 Jenkins Active Directory Plugin versions prior to 2.16.1 and 2.20

Description The issue allows attackers to log in as any user if a magic constant is used as the password. This is due to the shared code between user lookup and user authentication in the LDAP-based mode, where the magic constant is used in place of a real password to distinguish between these behaviors.

Recommendations For Jenkins Active Directory Plugin versions 1.44 through 2.19, update to version 2.20 or later. For Jenkins Active Directory Plugin versions prior to 2.16.1, update to version 2.16.1 or later. As a temporary workaround, consider restricting access to the LDAP-based mode until a patch is available.