CVE-2019-1003009

Severity: high (CVSS 7.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-06 · updated 2026-06-17
Weakness: CWE-295

Description

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

Affected products

Jenkins project Jenkins Active Directory Plugin: through 2.10

References

https://jenkins.io/security/advisory/2019-01-28/#SECURITY-859
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-859

Get alerted when CVE-2019-1003009 or the next vulnerability affects your stack