MEDIUM 4.3 Maven
Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page
GHSA-q6rq-4whr-r879 · CVE-2020-2302
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jenkins Active Directory Plugin 2.19 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to access the domain health check diagnostic page.
Jenkins Active Directory Plugin 2.20 requires Overall/Administer permission to access the domain health check diagnostic page.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes