CVE-2023-32993: Medium severity Jenkins Saml Single Sign On Jenkins vulnerability
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
Other sources
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.
This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.
SAML Single Sign On(SSO) Plugin 2.1.0 performs hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.jenkins.plugins:miniorange-saml-spto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
Jenkins SAML Single Sign On(SSO) Pluginto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32993?
CVE-2023-32993 has a medium severity level as it could allow man-in-the-middle attacks due to lack of hostname validation.
How do I fix CVE-2023-32993?
To fix CVE-2023-32993, upgrade the Jenkins SAML Single Sign On Plugin to version 2.1.0 or later.
What are the risks associated with CVE-2023-32993?
The risks associated with CVE-2023-32993 include potential unauthorized access to sensitive information and security breaches through man-in-the-middle attacks.
Which versions of Jenkins are affected by CVE-2023-32993?
Jenkins versions using the SAML Single Sign On Plugin 2.0.2 and earlier are affected by CVE-2023-32993.
What functionality does the SAML Single Sign On Plugin provide in Jenkins?
The SAML Single Sign On Plugin enables Jenkins users to authenticate with Identity Providers using the SAML protocol.