CVE-2023-32993

MEDIUM Year: 2023
CVSS v3 Score
4.8
Medium
Weakness Type
CWE-345
View all →

Vulnerability Description

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.

Related Vulnerabilities

CVE-2022-46422

MEDIUM
CVSS:4.8(Medium)

An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.

CWE-3452022

CVE-2020-3174

MEDIUM
CVSS:4.7(Medium)

A vulnerability in the anycast gateway feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a device to learn invalid Address Resolution Protocol (ARP) entries. T...

CWE-3452020

CVE-2017-1405

MEDIUM
CVSS:4.9(Medium)

IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM X-Force ID: 127392.

CWE-3452017

CVE-2021-21739

MEDIUM
CVSS:4.6(Medium)

A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data reliability, attackers could replace an authenticated optic...

CWE-3452021

CVE-2022-28385

MEDIUM
CVSS:4.6(Medium)

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated CD-ROM drive (containing the Windows and ...

CWE-3452022

CVE-2023-45586

MEDIUM
CVSS:5.0(Medium)

An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProx...

CWE-3452023