CVE-2022-4496

CVSS V2 None CVSS V3 None
Description
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.
Overview
  • CVE ID
  • CVE-2022-4496
  • Assigner
  • contact@wpscan.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-30T21:15:10
  • Last Modified Date
  • 2023-02-07T17:28:09
Weakness Enumerations
CWE URL
CWE-601 http://cwe.mitre.org/data/definitions/601.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:premium:wordpress:*:* 1 OR 12.0.0 12.1.0
cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:standard:wordpress:*:* 1 OR 16.0.0 16.0.8
cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:multisite:wordpress:*:* 1 OR 20.0.0 20.0.7
References
Reference URL Reference Tags
https://wpscan.com/vulnerability/af2e30c7-0787-4fe2-97ee-bc616f7178a1 Third Party Advisory
https://wpscan.com/vulnerability/be21f355-0e5b-4ad7-9d8f-85e9a0101ddc Third Party Advisory
https://wpscan.com/vulnerability/e6c4c8c7-1dcd-45bf-8582-f12accca6fac Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-4496
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4496
History
Created Old Value New Value Data Type Notes
2023-04-17 06:56:32 Added to TrackCVE
2023-04-17 06:56:33 Weakness Enumeration new