GHSA-ghpm-mgf5-cv8q
GitHub Security Advisory
Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
SAML Single Sign On(SSO) Plugin 2.0.1 removes the affected HTTP endpoint.
Affected Packages
Maven
io.jenkins.plugins:miniorange-saml-sp
Affected versions:
0
(fixed in 2.0.1)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: July 6, 2025 6:30 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.