CVE-2023-37945: A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive)...

Security readout for executives and security teams

This Jenkins plugin flaw can let a low-privileged Jenkins user view a string representation of the current security realm. That may expose authentication configuration details useful for reconnaissance, but the provided sources do not show code execution, privilege escalation, or active exploitation. Exposure is limited to Jenkins instances using the Jenkins SAML Single Sign On Plugin versions 2.1.0 through 2.3.0 inclusive, where untrusted or broad user populations have Overall/Read permission. Treat this as a near-term Jenkins hardening item, not an emergency absent exploitation evidence. Prioritize environments where Jenkins is internet-accessible or many users have read access. Mitigation focus: Identify Jenkins instances using the SAML Single Sign On Plugin.; Check whether installed plugin versions are 2.1.0 through 2.3.0 inclusive.; Follow the Jenkins advisory for the corrected version or vendor-recommended action..

Prepared

Jun 2, 2026, 01:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.