CVE-2023-37943

Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.

• CWE-311

• http://www.openwall.com/lists/oss-security/2023/07/12/2Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/07/12/2Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3059Vendor Advisory

Published

Jul 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37937An improper neutralization of special elements used in an os…7.8
• CVE-2023-37939An exposure of sensitive information to an unauthorized acto…3.3
• CVE-2023-3794A vulnerability classified as problematic has been found in …6.1
• CVE-2023-37940Cross-site scripting (XSS) vulnerability in the edit Service…4.8
• CVE-2023-37941If an attacker gains write access to the Apache Superset met…6.6
• CVE-2023-37942Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_1…6.5
• CVE-2023-37944A missing permission check in Jenkins Datadog Plugin 5.4.1 a…6.5
• CVE-2023-37945A missing permission check in Jenkins SAML Single Sign On(SS…4.3
• CVE-2023-37946Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and…8.8
• CVE-2023-37947Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and…6.1
• CVE-2023-37948Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 an…3.7
• CVE-2023-37949A missing permission check in Jenkins Orka by MacStadium Plu…7.1