CVE-2023-32992 – io.jenkins.plugins:miniorange-saml-sp

Package

Manager: maven
Name: io.jenkins.plugins:miniorange-saml-sp
Vulnerable Version: >=0 <2.1.0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00395 pctl0.59589

Details

Jenkins SAML Single Sign On(SSO) Plugin missing permission checks Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform permission checks in multiple HTTP endpoints. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML. As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. SAML Single Sign On(SSO) Plugin 2.1.0 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.

Metadata

Created: 2023-05-16T18:30:16Z
Modified: 2023-05-17T03:32:33Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-3xf9-pgc2-mr9c/GHSA-3xf9-pgc2-mr9c.json
CWE IDs: ["CWE-732"]
Alternative ID: GHSA-3xf9-pgc2-mr9c
Finding: F039
Auto approve: 1