Hostname Validation Flaw in Jenkins SAML Single Sign On Plugin by Jenkins

CVE-2023-32993

Summary

The Jenkins SAML Single Sign On Plugin, version 2.0.2 and earlier, is susceptible to a significant security issue where it fails to validate hostnames while connecting to miniOrange or other configured Identity Providers (IdPs) for SAML metadata retrieval. This oversight could enable malicious actors to exploit the vulnerability through man-in-the-middle attacks, potentially intercepting sensitive connections and compromising the security of user authentication processes. It is crucial for users to update the plugin to mitigate this risk.

References