CVE-2023-32993

Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32992

Missing permission checks in Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML...

CVE-2023-32992

Missing permission checks in Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML...

CVE-2023-32991

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML...

CVE-2023-32996: Incorrect Default Permissions

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

PT-2023-24127 · Jenkins · Jenkins Saml Single Sign On(Sso) Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SAML Single Sign OnSSO Plugin versions 2.0.0 and earlier Description: A missing permission check in the Jenkins SAML Single Sign OnSSO Plugin allows attackers with Overall/Read permission to send an HTTP POST request with a JSON body...

CVE-2023-32994: Improper Certificate Validation

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

PT-2023-9069 · Jenkins · Jenkins Saml Single Sign On(Sso) Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SAML Single Sign OnSSO Plugin versions 2.0.2 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a loca...

CVE-2023-32992: Incorrect Permission Assignment for Critical Resource

Missing permission checks in Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML...

CVE-2023-32995: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

PT-2023-3795

Name of the Vulnerable Software and Affected Versions Jenkins SAML Single Sign OnSSO Plugin versions 2.1.0 and earlier Description The issue is related to the lack of SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata. This could be...

CVE-2023-32991: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML...

PT-2023-24125

Name of the Vulnerable Software and Affected Versions Jenkins SAML Single Sign OnSSO Plugin versions 2.0.2 and earlier Description The issue is related to the lack of hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata. This could be abused using a...

CVE-2023-32993: Insufficient Verification of Data Authenticity

Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2022-34858

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

Authentication flaw

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

CVE-2022-34858 WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

CVE-2022-34858 WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

PT-2022-22398 · Miniorange · Miniorange Oauth 2.0 Client For Sso Plugin

Name of the Vulnerable Software and Affected Versions: miniOrange OAuth 2.0 client for SSO plugin versions = 1.11.3 Description: The issue is related to an Authentication Bypass vulnerability. It affects the miniOrange OAuth 2.0 client for SSO plugin at WordPress. Recommendations: For versions =...

Disabled users able to log in with third party SSO plugin

Impact Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address Patches Upgrade to 2.12.0 or later. Workarounds None. For more information If you have any questions or comments about this advisory: Email us at [email protected]...