CVE-2023-37943: Jenkins Active Directory Plugin vulnerable to Active Directory credential disclosure
Summary
CVE-2023-37943: Jenkins Active Directory Plugin vulnerable to Active Directory credential disclosure. Affects org.jenkins-ci.plugins:active-directory versions < 2.30.1. Fixed in 2.30.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Active Directory Plugin is a plugin for the Jenkins automation server that allows integration with Microsoft Active Directory. It provides functionality to authenticate users against an Active Directory server and retrieve user information. The plugin is commonly used in organizations that utilize Active Directory for user management and authentication. However, versions 2.30 and earlier of the plugin have a vulnerability that allows for the disclosure of Active Directory credentials.
Vulnerability Detail
The vulnerability in the Jenkins Active Directory Plugin (versions 2.30 and earlier) lies in the connection test functionality. When testing a new, unsaved configuration, the plugin performs a connection test to the Active Directory server. However, it ignores the "Require TLS" and "StartTls" options, resulting in an unencrypted connection test. This allows attackers who can capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials. It's important to note that this vulnerability only affects the connection test and not the encrypted connections established during the login process if the corresponding TLS option is enabled.
How To Fix
Latest published version: 2.971.v653d8b_6e5548 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.30.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the Jenkins Active Directory Plugin.
Conclusion
The Jenkins Active Directory Plugin (versions 2.30 and earlier) is vulnerable to Active Directory credential disclosure during the connection test. Upgrading to version 2.30.1 or later of the plugin fixes this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:active-directory →
FAQ
The vulnerability allows attackers to capture Active Directory credentials by intercepting network traffic between the Jenkins controller and Active Directory servers during the connection test.
No, this vulnerability only affects the unencrypted connection test. Encrypted connections established during the login process are not impacted if the corresponding TLS option is enabled.
Versions 2.30 and earlier of the Jenkins Active Directory Plugin are affected by this vulnerability.
Yes, upgrading to version 2.30.1 or later of the Jenkins Active Directory Plugin fixes this vulnerability.
There are no known exploits for this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:active-directory.
