CVE-2023-32993
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, whi…
Published: 2023-05-16 · CVSS: 4.8 · CVSS 3.1
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7