CVE-2023-32993 — Jenkins Project / Jenkins SAML Single Sign On(SSO) Plugin

CVE-2023-32993

Jenkins Project / Jenkins SAML Single Sign On(SSO) Plugin PUBLISHED

Description (CNA)

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins SAML Single Sign On(SSO) Plugin	affected 0 through 2.0.2

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(1)

ADP enrichment

CVE

No English description supplied.

https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(1)

CISA-ADP

No English description supplied.

No references supplied.