# org.jenkins-ci.plugins:active-directory (Maven) vulnerabilities 12 known vulnerabilities (2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.jenkins-ci.plugins/active-directory ## Advisories (12) ### [CVE-2026-57288](https://cve.now/CVE-2026-57288): Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows… - Severity: Low 3.7 - Published: Jun 24, 2026 - Affected: fixed in 2.41.2. ### [CVE-2026-48919](https://cve.now/CVE-2026-48919): Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. - Severity: Medium 6.6 - Published: May 27, 2026 - Affected: fixed in 2.41.1. ### [CVE-2026-48918](https://cve.now/CVE-2026-48918): Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. - Severity: Medium 6.6 - Published: May 27, 2026 - Affected: fixed in 2.41.1. ### [CVE-2023-37943](https://cve.now/CVE-2023-37943): Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test… - Severity: Unrated - Published: Jul 12, 2023 - Affected: fixed in 2.30.1. ### [CVE-2022-23105](https://cve.now/CVE-2022-23105): Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active… - Severity: Unrated - Published: Jan 12, 2022 - Affected: fixed in 2.25.1. ### [CVE-2020-2303](https://cve.now/CVE-2020-2303): A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform… - Severity: Unrated - Published: Nov 4, 2020 - Affected: fixed in 2.20. ### [CVE-2020-2302](https://cve.now/CVE-2020-2302): A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the… - Severity: Unrated - Published: Nov 4, 2020 - Affected: fixed in 2.20. ### [CVE-2020-2301](https://cve.now/CVE-2020-2301): Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful… - Severity: Unrated - Published: Nov 4, 2020 - Affected: from 2.17, fixed in 2.20; fixed in 2.16.1. ### [CVE-2020-2300](https://cve.now/CVE-2020-2300): Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows… - Severity: Unrated - Published: Nov 4, 2020 - Affected: from 2.17, fixed in 2.20; fixed in 2.16.1. ### [CVE-2020-2299](https://cve.now/CVE-2020-2299): Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password. - Severity: Unrated - Published: Nov 4, 2020 - Affected: from 2.17, fixed in 2.20; from 1.44, fixed in 2.16.1. ### [CVE-2019-1003009](https://cve.now/CVE-2019-1003009): An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in… - Severity: Unrated - Published: Feb 6, 2019 - Affected: fixed in 2.11. ### [CVE-2017-2649](https://cve.now/CVE-2017-2649): It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active… - Severity: Unrated - Published: Jul 27, 2018 - Affected: fixed in 2.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.jenkins-ci.plugins:active-directory Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.