GHSA-w88f-j9rc-h7v3MediumCVSS 4.3

Jenkins SAML Single Sign On(SSO) Plugin missing permission checks

Published
May 16, 2023
Last Modified
November 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-32996 →

📋 Description

Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

SAML Single Sign On(SSO) Plugin 2.0.1 removes the affected HTTP endpoint.

🎯 Affected products1

  • maven/io.jenkins.plugins:miniorange-saml-sp:< 2.0.1

🔗 References (3)