CVE-2020-2303: CSRF vulnerability in Jenkins Active Directory Plugin
Summary
CVE-2020-2303: CSRF vulnerability in Jenkins Active Directory Plugin. Affects org.jenkins-ci.plugins:active-directory versions < 2.20. Fixed in 2.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Active Directory Plugin is a Maven package that provides integration with Microsoft Active Directory for user authentication and authorization in Jenkins. It allows Jenkins to authenticate users against an Active Directory server and manage user groups and permissions based on Active Directory groups. The plugin is widely used in Jenkins installations to enable seamless integration with Active Directory environments.
Vulnerability Detail
The Active Directory Plugin version 2.19 and earlier suffer from a cross-site request forgery (CSRF) vulnerability. These versions do not require POST requests for multiple HTTP endpoints used for connection and authentication tests. This allows an attacker to perform connection tests using attacker-specified or previously configured Active Directory servers and credentials. The vulnerability can be exploited by tricking a user with sufficient privileges to visit a malicious website or click on a specially crafted link. Successful exploitation of this vulnerability could lead to unauthorized access to Active Directory servers and potential compromise of user credentials.
How To Fix
Latest published version: 2.971.v653d8b_6e5548 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the Active Directory Plugin as soon as possible.
Conclusion
The CSRF vulnerability in the Jenkins Active Directory Plugin (CVE-2020-2303) allows attackers to perform unauthorized connection tests and potentially compromise user credentials. To mitigate this vulnerability, it is crucial to upgrade to Active Directory Plugin version 2.20 or later, which requires POST requests for the affected HTTP endpoints. Additionally, it is recommended to review and update the plugin's configuration to ensure the use of trusted Active Directory servers and credentials. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:active-directory →
FAQ
This vulnerability allows attackers to perform connection tests using attacker-specified or previously configured Active Directory servers and credentials. It could lead to unauthorized access to Active Directory servers and potential compromise of user credentials.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for open-source vulnerabilities, including this CSRF vulnerability in the Active Directory Plugin.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix as soon as possible to mitigate the risk.
Yes, this vulnerability can be exploited remotely by tricking a user with sufficient privileges to visit a malicious website or click on a specially crafted link.
There is no evidence of active attacks exploiting this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:active-directory.
