Lucene search
GitHub Advisory DatabaseGHSA-GHPM-MGF5-CV8QHistoryMay 16, 2023 - 6:30 p.m.
Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability
2023-05-1618:30:16
CWE-352
GitHub Advisory Database
github.com
7
jenkins
saml
single sign on
cross-site request forgery
csrf
vulnerability
http
endpoint
miniorange
api
0.001 Low
EPSS
Percentile
38.7%
Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
SAML Single Sign On(SSO) Plugin 2.0.1 removes the affected HTTP endpoint.
| CPE | Name | Operator | Version |
|---|---|---|---|
| io.jenkins.plugins:miniorange-saml-sp | lt | 2.0.1 |
Related
cve
cve
CVE-2023-32995
2023-05-16 17:15:11
cvelist
cvelist
CVE-2023-32995
2023-05-16 16:00:13
prion
prion
Cross site request forgery (csrf)
2023-05-16 17:15:00
osv
osv
