Lucene search

JenkinsCVELIST:CVE-2023-32993

HistoryMay 16, 2023 - 4:00 p.m.

CVE-2023-32993

2023-05-1616:00:12

jenkins

www.cve.org

jenkins

saml

single sign on

plugin

hostname validation

man-in-the-middle

attack

intercept connections

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

18.3%

JSON

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins SAML Single Sign On(SSO) Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "2.0.2",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(1)