CVE-2026-57288

Katalog CVE

CVSS 3.7 · Low EPSS 0,33%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada jenkins active directory. Skor CVSS 3.1 3.7 (Low) menurut CISA ADP.

Deskripsi (NVD)

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.

Rincian

Terbit di NVD

24 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3651 advisory vendor