cbcvebase.
CVE-2023-32994
published 2023-05-16

CVE-2023-32994: Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the…

PriorityP413low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
0.24%
14.8th percentile
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.

Affected

24 ranges
VendorProductVersion rangeFixed in
jenkinsansible_plugin——
jenkinsappspider_plugin——
jenkinsazure_vm_agents_plugin——
jenkinscas_plugin——
jenkinscode_dx_plugin——
jenkinscredentials_plugin——
jenkinsemail_extension_plugin——
jenkinsfile_parameter_plugin——
jenkinshashicorp_vault_plugin——
jenkinsids_in_azure_vm_agents_plugin——
jenkinsimproper_masking_of_credentials_in_hashicorp_vault_plugin——
jenkinsjob_plugin——
jenkinsldap_plugin——
jenkinsloadcomplete_support_plugin——
jenkinsns-nd_integration_performance_publisher_plugin——
jenkinspipeline_utility_steps_plugin——
jenkinsreverse_proxy_auth_plugin——
jenkinssaml_single_sign_on<= 2.1.0—
jenkinssidebar_link_plugin——
jenkinstag_profiler_plugin——
jenkinstestcomplete_support_plugin——
jenkinstestng_report_files_and_displayed_on_the_plugin——
jenkinstestng_results_plugin——
jenkins_projectjenkins_saml_single_sign_on_plugin<= 2.1.0—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.