CVE-2023-32994: 
Java vulnerability analysis and mitigation

Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier contains a security vulnerability where SSL/TLS certificate validation is unconditionally disabled for connections to miniOrange or the configured IdP when retrieving SAML metadata. The vulnerability was discovered and disclosed on May 16, 2023 (Jenkins Advisory).

The vulnerability is classified as Medium severity with a CVSS v3.1 base score of 3.7 LOW (Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). The core issue stems from the plugin unconditionally disabling SSL/TLS certificate validation when making connections to retrieve SAML metadata, either from miniOrange or a configured Identity Provider (IdP) (NVD).

The lack of SSL/TLS certificate validation could be exploited by attackers using man-in-the-middle attacks to intercept connections between Jenkins and the SAML metadata providers. This could potentially lead to unauthorized access to sensitive information exchanged during the SAML authentication process (Jenkins Advisory).

The vulnerability has been fixed in SAML Single Sign On(SSO) Plugin version 2.2.0, which properly performs SSL/TLS certificate validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata. Users are advised to upgrade to this version to address the security issue (Jenkins Advisory).