Unencrypted Connection Issues in Jenkins Active Directory Plugin Affects Security

CVE-2023-37943

Summary

The Jenkins Active Directory Plugin versions up to 2.30 have a critical security flaw where the 'Require TLS' and 'StartTLS' settings are ignored. This oversight results in the plugin always connecting to Active Directory using unencrypted connections. As a consequence, attackers can intercept network traffic between the Jenkins controller and Active Directory servers, putting sensitive user credentials at significant risk. It is imperative for users of affected versions to promptly apply any available updates to mitigate this exposure.

References