Description
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
Remediation
References
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-859
Related Vulnerabilities
CVE-2019-3772 Vulnerability in maven package org.springframework.integration:spring-integration-ws
CVE-2011-5063 Vulnerability in maven package tomcat:catalina
CVE-2022-45384 Vulnerability in maven package org.jenkins-ci.plugins:reverse-proxy-auth-plugin
CVE-2019-3797 Vulnerability in maven package org.springframework.data:spring-data-jpa
CVE-2011-1184 Vulnerability in maven package org.apache.tomcat:tomcat-catalina