High severity7.4NVD Advisory· Published Feb 6, 2019· Updated Jun 17, 2026

CVE-2019-1003009

Description

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:active-directoryMaven	< 2.11	2.11

Affected products

Jenkins Project/Active Directory
cpe:2.3:a:jenkins:active_directory:*:*:*:*:*:jenkins:*:*
Range: <=2.10
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/active-directory
Range: < 2.11
Jenkins Project/Active Directory Jenkins Plugincpe-rescue
Range: 2.10 and earlier

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-2h95-4xw9-m68jghsaADVISORY
jenkins.io/security/advisory/2019-01-28/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-1003009ghsaADVISORY
github.com/jenkinsci/active-directory-plugin/commit/520faf5bb1078d75e5fed10b7bf5ac6241fe2fc4ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000