PT-2023-24125 · Jenkins · Jenkins Saml Single Sign On(Sso) Plugin+1

Yaroslav Afenkin · Publicado 2023-05-16 · Atualizado 2023-05-26 · CVE-2023-32993

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SAML Single Sign On(SSO) Plugin versions 2.0.2 and earlier

Description The issue is related to the lack of hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata. This could be abused using a man-in-the-middle attack to intercept these connections.

Recommendations For Jenkins SAML Single Sign On(SSO) Plugin versions 2.0.2 and earlier, update to version 2.1.0 or later, which performs hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.

Correção

Insufficient Verification of Data Authenticity

Origin Validation Error

Enumeração de Fraquezas

CWE-345

CWE-346

Identificadores relacionados

CVE-2023-32993

GHSA-6V6H-RW43-97FH

Produtos afetados

Jenkins

Jenkins Saml Single Sign On(Sso) Plugin

Referências · 6

• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(1) · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32993 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6v6h-rw43-97fh · Aviso do Fabricante
• https://t.me/cibsecurity/64232 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-32993 · Aviso do Fabricante
• https://t.me/cvenotify/50578 · Publicação no Telegram