PT-2023-24127 · Jenkins · Jenkins Saml Single Sign On(Sso) Plugin+1

Kevin Guerroudj · Published 2023-05-16 · Updated 2023-05-31 · CVE-2023-32996

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SAML Single Sign On(SSO) Plugin versions 2.0.0 and earlier

Description A missing permission check in the Jenkins SAML Single Sign On(SSO) Plugin allows attackers with Overall/Read permission to send an HTTP POST request with a JSON body containing attacker-specified content to miniOrange's API for sending emails. This issue also results in a cross-site request forgery (CSRF) vulnerability, as the affected HTTP endpoint does not require POST requests.

Recommendations For Jenkins SAML Single Sign On(SSO) Plugin versions 2.0.0 and earlier, update to version 2.0.1 or later, which removes the affected HTTP endpoint. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoint to minimize the risk of exploitation. Additionally, restrict the use of the Overall/Read permission to prevent attackers from sending malicious requests to miniOrange's API.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2023-32996

GHSA-W88F-J9RC-H7V3

Affected Products

Jenkins

Jenkins Saml Single Sign On(Sso) Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-w88f-j9rc-h7v3 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-2994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32996 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32996 · Vendor Advisory
• https://t.me/cibsecurity/64231 · Telegram Post
• https://t.me/cvenotify/50575 · Telegram Post