medium4.3
CVE-2023-32996
Jenkins SAML Single Sign On(SSO) Plugin missing permission checks
Impact
Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails. Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. SAML Single Sign On(SSO) Plugin 2.0.1 removes the affected HTTP endpoint.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:miniorange-saml-sp | < 2.0.1 | 2.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Saml Single Sign-On | through 2.0.0 |