CVE-2023-32996
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A missing permission check in Jenkins SAML Single Sign On (SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content to miniOrange's API for sending emails.
Risk Assessment
Attackers can exploit this vulnerability to send unauthorized emails, potentially leading to abuse and loss of trust in the system.
Recommendation
It is recommended to update the plugin to the latest version to remove the missing permission check and restrict access to the miniOrange API.
Original NVD description (English source)
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.