Man-in-the-Middle (MitM) attack in SAML Single Sign On(SSO) - CVE-2023-32993

 

Man-in-the-Middle (MitM) attack in SAML Single Sign On(SSO) - CVE-2023-32993

Published: May 17, 2023


Vulnerability identifier: #VU76251
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-32993
CWE-ID: CWE-300
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected plugin does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata. A remote attacker can perform a man-in-the-middle attack to intercept these connections.


Affected software

SAML Single Sign On(SSO)

How to mitigate CVE-2023-32993

Install updates from vendor's website.

SAML Single Sign On(SSO) - update to 2.1.0

External References

Related Security Bulletins