CVE-2023-37943
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Jenkins Active Directory Plugin version 2.30 and earlier ignores the 'Require TLS' and 'StartTls' options, resulting in an unencrypted connection test to Active Directory servers.
Risk Assessment
Attackers can capture network traffic between the Jenkins controller and Active Directory servers, allowing them to obtain Active Directory credentials.
Recommendation
It is recommended to update the Active Directory plugin to the latest version to ensure proper encryption of connections.
Original NVD description (English source)
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.