medium4.3
CVE-2023-37945
Jenkins SAML Single Sign On(SSO) Plugin missing permission check
Impact
Jenkins SAML Single Sign On(SSO) Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to download a string representation of the current security realm (Java `Object#toString()`), which potentially includes sensitive information. SAML Single Sign On(SSO) Plugin 2.3.1 requires Overall/Administer permission to access the affected HTTP endpoint, and only allows downloading a string representation if the current security realm is this plugin’s.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:miniorange-saml-sp | < 2.3.1 | 2.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Saml Single Sign On | from 2.1.0 before 2.3.1 |