Man-in-the-Middle (MitM) attack in SAML Single Sign On(SSO) - CVE-2023-32993
Published: May 17, 2023
Vulnerability identifier: #VU76251
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-32993
CWE-ID: CWE-300
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Jenkins
Affected software:
SAML Single Sign On(SSO)
SAML Single Sign On(SSO)
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected plugin does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata. A remote attacker can perform a man-in-the-middle attack to intercept these connections.
How to mitigate CVE-2023-32993
Install updates from vendor's website.