CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2023-32995
High (8.8) in jenkins saml single sign on. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in io.jenkins.plugins:miniorange-saml-sp 2.0.1.
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:saml_single_sign_on
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ghpm-mgf5-cv8q | Maven | io.jenkins.plugins:miniorange-saml-sp | <2.0.1 | 2.0.1 |