4.8
Moyenne
CVE-2023-32993 Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to…
Description
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jenkins SAML Single Sign On(SSO) Plugin 2.0 | premières → 2.0.2 | Pas de correctif indiqué |
Autres CVE de Jenkins SAML Single Sign On(SSO) Plugin
Les 7 CVE de Jenkins SAML Single Sign On(SSO) Plugin →
CVE-2023-37945
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows…
Non notée
CVE-2023-32996
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with…
4.3
Moyenne
CVE-2023-32994
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for…
3.7
Faible
CVE-2023-32995
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows…
8.8
Élevée