CVE-2017-2649

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Jenkins project	Active Directory Jenkins plugin	<= 2.2

References

http://www.securityfocus.com/bid/96986Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2017-03-20/Vendor Advisory
http://www.securityfocus.com/bid/96986Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2017-03-20/Vendor Advisory

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26508.5It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM comm CVE-2017-26513.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically CVE-2017-26528.8It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provi CVE-2017-26536.5A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST reques CVE-2017-26545.3jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dy CVE-2017-26586.5It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Se CVE-2017-26597.5It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is CVE-2017-26616.1ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field w CVE-2017-26624.3A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filte CVE-2017-26637.8It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and c CVE-2017-26646.5CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application port CVE-2017-26657.0The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.