CVE-2020-2302: Jenkins Active Directory Plugin Missing Permission Check
Summary
CVE-2020-2302: Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page. Affects org.jenkins-ci.plugins:active-directory versions < 2.20. Fixed in 2.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Active Directory Plugin is a plugin for the Jenkins automation server that allows integration with Microsoft Active Directory for user authentication and authorization. It provides functionality to authenticate users against an Active Directory server and manage user groups and permissions within Jenkins. The plugin is widely used in organizations that rely on Active Directory for user management. However, versions 2.19 and earlier of the plugin have a vulnerability that allows unauthorized access to the domain health check diagnostic page.
Vulnerability Detail
The vulnerability in the Active Directory Plugin (versions 2.19 and earlier) is due to a missing permission check in an HTTP endpoint. Attackers with Overall/Read permission can exploit this vulnerability to access the domain health check diagnostic page. This page provides detailed information about the health of the Active Directory domain integrated with Jenkins. Unauthorized access to this page can expose sensitive information about the domain, potentially aiding attackers in further compromising the system. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.971.v653d8b_6e5548 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, organizations can mitigate the risk by restricting access to the Jenkins server and ensuring that only trusted users have Overall/Read permission. Additionally, monitoring access logs and implementing intrusion detection systems can help detect and prevent unauthorized access attempts.
Conclusion
The Active Directory Plugin in Jenkins versions 2.19 and earlier is vulnerable to unauthorized access to the domain health check diagnostic page. Upgrading to version 2.20 or later of the plugin is recommended to fix this vulnerability and ensure that only authorized users with administrative privileges can access the sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:active-directory →
FAQ
The vulnerability allows unauthorized users with Overall/Read permission to access the domain health check diagnostic page, potentially exposing sensitive information about the Active Directory domain integrated with Jenkins.
Organizations using Jenkins with the Active Directory Plugin versions 2.19 and earlier are affected by this vulnerability.
Yes, upgrading to version 2.20 or later of the Active Directory Plugin fixes this vulnerability by introducing a permission check.
While there is no specific workaround mentioned, organizations can mitigate the risk by restricting access to the Jenkins server and ensuring that only trusted users have Overall/Read permission.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:active-directory.
