CVE-2020-2300
Improper Authentication (empty password) in Jenkins Active Directory Plugin
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
- Record
CVE-2020-2300- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
- Record
CVE-2020-2300- Updated
- 2026-11-02
EUVDEUVD-2022-3251 No score
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
- Record
EUVD-2022-3251- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8wcw-cw2f-h4g2
Improper Authentication (empty password) in Jenkins Active Directory Plugin
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode.
The Windows/ADSI mode does not specifically prohibit use of empty passwords in Active Directory Plugin prior to 2.20 and 2.16.1. If the Active Directory server allows the unauthenticated bind operation, this allows attackers to log in to Jenkins as any user by providing an empty password.
Jenkins Active Directory Plugin 2.20 and 2.16.1 prohibits the use of an empty password to log in.
- Record
GHSA-8wcw-cw2f-h4g2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
- Record
CVE-2020-2300- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-8wcw-cw2f-h4g2
Improper Authentication (empty password) in Jenkins Active Directory Plugin
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode.
The Windows/ADSI mode does not specifically prohibit use of empty passwords in Active Directory Plugin prior to 2.20 and 2.16.1. If the Active Directory server allows the unauthenticated bind operation, this allows attackers to log in to Jenkins as any user by providing an empty password.
Jenkins Active Directory Plugin 2.20 and 2.16.1 prohibits the use of an empty password to log in.
- Record
GHSA-8wcw-cw2f-h4g2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:active-directoryMaven |
2.17 up to 2.20 | 2.20 |
org.jenkins-ci.plugins:active-directoryMaven |
before 2.16.1 | 2.16.1 |
org.jenkins-ci.plugins:active-directoryMaven |
2.17 up to 2.20, plus listed versions 2.182.19 |
2.20 |
org.jenkins-ci.plugins:active-directoryMaven |
before 2.16.1, plus listed versions 1.181.191.201.211.22 Show 43 moreShow less1.231.241.251.261.271.281.291.301.311.321.331.341.351.361.371.381.391.411.421.431.441.451.461.471.481.492.02.12.102.112.122.132.142.152.162.22.32.42.52.62.72.82.9 |
2.16.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2300 is a critical vulnerability (CVSS 9.8) in Jenkins Active Directory, published November 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 76th percentile. Fixed in org.jenkins-ci.plugins:active-directory 2.20.
References
jenkins.io/security/advisory/2020-11-04
openwall.com/lists/oss-security/2020/11/04/6
nvd.nist.gov/vuln/detail/CVE-2020-2300
github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2300.json