CVE-2020-2301
Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
- Record
CVE-2020-2301- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
- Record
CVE-2020-2301- Updated
- 2026-11-02
EUVDEUVD-2022-3291 No score
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
- Record
EUVD-2022-3291- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-954f-xw44-56r2
Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. Optionally, to reduce lookup time, a cache can be configured to remember user lookups and user authentications.
In Active Directory Plugin prior to 2.20 and 2.16.1, when run in Windows/ADSI mode, the provided password was not used when looking up an applicable cache entry. This allows attackers to log in as any user using any password while a successful authentication of that user is still in the cache.
As a workaround for this issue, the cache can be disabled.
Active Directory Plugin 2.20 and 2.16.1 includes the provided password in cache entry lookup.
Additionally, the Java system property hudson.plugins.active_directory.CacheUtil.noCacheAuth can be set to true to no longer cache user authentications.
- Record
GHSA-954f-xw44-56r2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
- Record
CVE-2020-2301- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-954f-xw44-56r2
Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. Optionally, to reduce lookup time, a cache can be configured to remember user lookups and user authentications.
In Active Directory Plugin prior to 2.20 and 2.16.1, when run in Windows/ADSI mode, the provided password was not used when looking up an applicable cache entry. This allows attackers to log in as any user using any password while a successful authentication of that user is still in the cache.
As a workaround for this issue, the cache can be disabled.
Active Directory Plugin 2.20 and 2.16.1 includes the provided password in cache entry lookup.
Additionally, the Java system property hudson.plugins.active_directory.CacheUtil.noCacheAuth can be set to true to no longer cache user authentications.
- Record
GHSA-954f-xw44-56r2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:active-directoryMaven |
2.17 up to 2.20 | 2.20 |
org.jenkins-ci.plugins:active-directoryMaven |
before 2.16.1 | 2.16.1 |
org.jenkins-ci.plugins:active-directoryMaven |
2.17 up to 2.20, plus listed versions 2.182.19 |
2.20 |
org.jenkins-ci.plugins:active-directoryMaven |
before 2.16.1, plus listed versions 1.181.191.201.211.22 Show 43 moreShow less1.231.241.251.261.271.281.291.301.311.321.331.341.351.361.371.381.391.411.421.431.441.451.461.471.481.492.02.12.102.112.122.132.142.152.162.22.32.42.52.62.72.82.9 |
2.16.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2301 is a critical vulnerability (CVSS 9.8) in Jenkins Active Directory, published November 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in org.jenkins-ci.plugins:active-directory 2.20.
References
jenkins.io/security/advisory/2020-11-04
nvd.nist.gov/vuln/detail/CVE-2020-2301
github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2301.json