Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Advisory: Jenkins SAML Single Sign On(SSO) Plugin — Jenkins Security Advisory 2023-05-16 Clear all filters
TI-2023-16184 CVE-2023-32996 · GHSA-w88f-j9rc-h7v3

Incorrect default permissions in Jenkins SAML Single Sign On Plugin

Priority LOW 20

A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00425 Published 2023-05-16 Fixed in 2.0.1 CWE-276
TI-2023-16183 CVE-2023-32995 · GHSA-ghpm-mgf5-cv8q

Cross-site request forgery in Jenkins SAML Single Sign On Plugin

Priority MEDIUM 40

A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOr…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0045 Published 2023-05-16 Fixed in 2.0.1 CWE-352
TI-2023-16182 CVE-2023-32994 · GHSA-9m92-qwpc-qm78

Improper certificate validation in Jenkins SAML Single Sign On Plugin

Priority LOW 17

Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00244 Published 2023-05-16 Fixed in 2.2.0 CWE-295
TI-2023-16181 CVE-2023-32993 · GHSA-6v6h-rw43-97fh

Origin validation error in Jenkins SAML Single Sign On Plugin

Priority LOW 21

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middl…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00209 Published 2023-05-16 Fixed in 2.1.0 CWE-346
TI-2023-16180 CVE-2023-32992 · GHSA-3xf9-pgc2-mr9c

Incorrect permission assignment in Jenkins SAML Single Sign On Plugin

Priority MEDIUM 42

Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or p…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00832 Published 2023-05-16 Fixed in 2.1.0 CWE-732
TI-2023-16179 CVE-2023-32991 · GHSA-xw6j-mq6v-pmv6

Cross-site request forgery in Jenkins SAML Single Sign On Plugin

Priority MEDIUM 41

A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00681 Published 2023-05-16 Fixed in 2.1.0 CWE-352