cbcvebase.
CVE-2023-32993
published 2023-05-16

CVE-2023-32993: Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve…

medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.

Affected

24 ranges
VendorProductVersion rangeFixed in
jenkinsansible_plugin
jenkinsappspider_plugin
jenkinsazure_vm_agents_plugin
jenkinscas_plugin
jenkinscode_dx_plugin
jenkinscredentials_plugin
jenkinsemail_extension_plugin
jenkinsfile_parameter_plugin
jenkinshashicorp_vault_plugin
jenkinsids_in_azure_vm_agents_plugin
jenkinsimproper_masking_of_credentials_in_hashicorp_vault_plugin
jenkinsjob_plugin
jenkinsldap_plugin
jenkinsloadcomplete_support_plugin
jenkinsns-nd_integration_performance_publisher_plugin
jenkinspipeline_utility_steps_plugin
jenkinsreverse_proxy_auth_plugin
jenkinssaml_single_sign_on<= 2.0.2
jenkinssidebar_link_plugin
jenkinstag_profiler_plugin
jenkinstestcomplete_support_plugin
jenkinstestng_report_files_and_displayed_on_the_plugin
jenkinstestng_results_plugin
jenkins_projectjenkins_saml_single_sign_on_plugin<= 2.0.2