Description
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.
Remediation
References
http://www.securityfocus.com/bid/96986
https://jenkins.io/security/advisory/2017-03-20/
Related Vulnerabilities
CVE-2020-35490 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2022-0350 Vulnerability in npm package vditor
CVE-2023-26111 Vulnerability in npm package @nubosoftware/node-static
CVE-2022-23539 Vulnerability in maven package org.webjars.npm:jsonwebtoken
CVE-2018-1339 Vulnerability in maven package org.apache.tika:tika-parsers