Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. Optionally, to reduce lookup time, a cache can be configured to remember user lookups and user authentications.
In Active Directory Plugin prior to 2.20 and 2.16.1, when run in Windows/ADSI mode, the provided password was not used when looking up an applicable cache entry. This allows attackers to log in as any user using any password while a successful authentication of that user is still in the cache.
As a workaround for this issue, the cache can be disabled.
Active Directory Plugin 2.20 and 2.16.1 includes the provided password in cache entry lookup.
Additionally, the Java system property hudson.plugins.active_directory.CacheUtil.noCacheAuth can be set to true to no longer cache user authentications.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.jenkins-ci.plugins:active-directory | >= 2.17, < 2.20, < 2.16.1 | 2.20, 2.16.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-2301
- https://github.com/jenkinsci/active-directory-plugin/commit/57e78ea7bb96b4e59405f28959ade2d26821163d
- https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2301.json
- https://github.com/jenkinsci/active-directory-plugin
- https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-287- Platform
- Java / Kotlin (Maven)
- Package
org.jenkins-ci.plugins:active-directory- Disclosed
- 24.05.2022
- Updated
- 11.10.2026 11:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-954f-xw44-56r2 - CC BY 4.0
Vulnerability history: org.jenkins-ci.plugins:active-directory
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 12
- First → latest
- 01.2022 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 2
- Medium 6
- Low 1
Disclosures per year
- 2022: 8
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 3
-
Authentication cache in Active Directory Jenkins Plugin allows logging in with any password this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.