Authentication Bypass in Jenkins Active Directory Plugin

CVE-2020-2301

Summary

The Jenkins Active Directory Plugin prior to version 2.20 suffers from an authentication bypass flaw, enabling attackers to impersonate any user with any password, as long as the successful authentication of that user is still present in the cache during Windows/ADSI mode usage. This flaw presents significant security implications, allowing unauthorized access to user accounts and potentially compromising sensitive information.

References