- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 2 medium, 1 low
- Registry
- Maven Central
Advisories 12
- CVE-2026-57288Low 3.7
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows…
Affected: fixed in 2.41.2.
- CVE-2026-48919Medium 6.6
Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.
Affected: fixed in 2.41.1.
- CVE-2026-48918Medium 6.6
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
Affected: fixed in 2.41.1.
- CVE-2023-37943Unrated
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test…
Affected: fixed in 2.30.1.
- CVE-2022-23105Unrated
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active…
Affected: fixed in 2.25.1.
- CVE-2020-2303Unrated
A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform…
Affected: fixed in 2.20.
- CVE-2020-2302Unrated
A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the…
Affected: fixed in 2.20.
- CVE-2020-2301Unrated
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful…
Affected: from 2.17, fixed in 2.20; fixed in 2.16.1.
- CVE-2020-2300Unrated
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows…
Affected: from 2.17, fixed in 2.20; fixed in 2.16.1.
- CVE-2020-2299Unrated
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.
Affected: from 2.17, fixed in 2.20; from 1.44, fixed in 2.16.1.
- CVE-2019-1003009Unrated
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in…
Affected: fixed in 2.11.
- CVE-2017-2649Unrated
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active…
Affected: fixed in 2.3.