-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:active-directory | maven | >= 2.17, < 2.20 | 2.20 |
| org.jenkins-ci.plugins:active-directory | maven | < 2.16.1 | 2.16.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper cache key construction in Windows/ADSI mode. The original implementation in ActiveDirectoryAuthenticationProvider.java's retrieveUser() method used a username-only cache key (Cache<String, UserDetails>). This allowed cached authentication entries to be reused regardless of the provided password. The commit introduced CacheKey (with username + password hash) and modified the cache to use it, confirming the flaw was in the cache key handling during authentication checks.