Cleartext transmission of sensitive information in Active Directory - CVE-2022-23105
Published: January 13, 2022
Vulnerability identifier: #VU59591
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-23105
CWE-ID: CWE-319
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the affected plugin does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
Affected software
Active Directory
How to mitigate CVE-2022-23105
Install updates from vendor's website.
Active Directory - update to 2.25.1