cbcvebase.
CVE-2023-32995
published 2023-05-16

CVE-2023-32995: A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request…

PriorityP338high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.45%
36.2th percentile
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.

Affected

24 ranges
VendorProductVersion rangeFixed in
jenkinsansible_plugin——
jenkinsappspider_plugin——
jenkinsazure_vm_agents_plugin——
jenkinscas_plugin——
jenkinscode_dx_plugin——
jenkinscredentials_plugin——
jenkinsemail_extension_plugin——
jenkinsfile_parameter_plugin——
jenkinshashicorp_vault_plugin——
jenkinsids_in_azure_vm_agents_plugin——
jenkinsimproper_masking_of_credentials_in_hashicorp_vault_plugin——
jenkinsjob_plugin——
jenkinsldap_plugin——
jenkinsloadcomplete_support_plugin——
jenkinsns-nd_integration_performance_publisher_plugin——
jenkinspipeline_utility_steps_plugin——
jenkinsreverse_proxy_auth_plugin——
jenkinssaml_single_sign_on<= 2.0.0—
jenkinssidebar_link_plugin——
jenkinstag_profiler_plugin——
jenkinstestcomplete_support_plugin——
jenkinstestng_report_files_and_displayed_on_the_plugin——
jenkinstestng_results_plugin——
jenkins_projectjenkins_saml_single_sign_on_plugin<= 2.0.0—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.