Skip to content
OpenAdvisories
High · 8.8 CVE-2021-21678 EUVD-2022-5102GHSA-r5w3-pfq8-3r82

Jenkins SAML Plugin allows bypassing CSRF protection for any URL

Published Aug 31, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins SAML Plugin Package: org.jenkins-ci.plugins:saml Category: Web / CMS Ecosystem: Maven

Description

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins SAML Plugin 1.1.3 – < unspecified, unspecified – ≤ 2.0.7 unspecified

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:saml < 2.0.8 2.0.8 GHSA-r5w3-pfq8-3r82

References