CVE-2020-2301: Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
Summary
CVE-2020-2301: Authentication cache in Active Directory Jenkins Plugin allows logging in with any password. Affects org.jenkins-ci.plugins:active-directory across 2 version ranges.
< 2.16.1
>= 2.17, < 2.20
Fixed in 2.16.1 or 2.20, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Active Directory Plugin is a Jenkins plugin that provides integration with Active Directory for user authentication and authorization. It supports two modes: Integration with ADSI on Windows and an OS-agnostic LDAP-based mode. The plugin allows users to authenticate against an Active Directory server and provides caching functionality to improve lookup time for user authentications.
Vulnerability Detail
The vulnerability in Active Directory Plugin prior to version 2.20 and 2.16.1 allows attackers to log in as any user using any password while a successful authentication of that user is still in the cache. In Windows/ADSI mode, the provided password is not used when looking up a cache entry, allowing unauthorized access. This can lead to unauthorized access to Jenkins and potential misuse of user privileges.
How To Fix
Latest published version: 2.971.v653d8b_6e5548 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.16.12.16.1 -
>= 2.17, < 2.202.20
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, the cache can be disabled by setting the Java system property 'hudson.plugins.active_directory.CacheUtil.noCacheAuth' to 'true'. This will prevent user authentications from being cached and mitigate the vulnerability. However, disabling the cache may impact performance, especially in environments with a large number of user authentications.
Conclusion
The Active Directory Plugin in Jenkins is vulnerable to an authentication cache bypass, allowing unauthorized access to Jenkins. It is crucial to upgrade to the fixed versions (2.20 or 2.16.1) or disable the cache to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:active-directory →
FAQ
This vulnerability allows attackers to log in as any user using any password while a successful authentication of that user is still in the cache. This can lead to unauthorized access to Jenkins and potential misuse of user privileges.
To fix this vulnerability, it is recommended to upgrade to Active Directory Plugin version 2.20 or 2.16.1. These versions include the provided password in cache entry lookup, ensuring that the correct password is used for authentication. Additionally, the cache can be disabled by setting the Java system property 'hudson.plugins.active_directory.CacheUtil.noCacheAuth' to 'true'.
Yes, you can mitigate the vulnerability by disabling the cache. Set the Java system property 'hudson.plugins.active_directory.CacheUtil.noCacheAuth' to 'true' to prevent user authentications from being cached. However, this may impact performance in environments with a large number of user authentications.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-954f-xw44-56r2/GHSA-954f-xw44-56r2.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:active-directory.
