Vulnerability Description
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Saml Single Sign On | <= 2.0.2 |
Related Weaknesses (CWE)
References
- https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(1)Vendor Advisory
- https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(1)Vendor Advisory
FAQ
What is CVE-2023-32993?
CVE-2023-32993 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused usin...
How severe is CVE-2023-32993?
CVE-2023-32993 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-32993?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Saml Single Sign On.