4.8
Medium
CVE-2023-32993 Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to…
Description
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins SAML Single Sign On(SSO) Plugin 2.0 | earliest → 2.0.2 | No fix stated |
Other CVEs of Jenkins SAML Single Sign On(SSO) Plugin
The 7 CVEs of Jenkins SAML Single Sign On(SSO) Plugin →
CVE-2023-37945
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows…
Not rated
CVE-2023-32996
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with…
4.3
Medium
CVE-2023-32994
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for…
3.7
Low
CVE-2023-32995
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows…
8.8
High