CVE-2023-1092

CVSS V2 None CVSS V3 None
Description
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
Overview
  • CVE ID
  • CVE-2023-1092
  • Assigner
  • contact@wpscan.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-27T16:15:09
  • Last Modified Date
  • 2023-04-03T16:07:32
Weakness Enumerations
CWE URL
CWE-352 http://cwe.mitre.org/data/definitions/352.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:free:wordpress:*:* 1 OR 6.24.2
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:standard:wordpress:*:* 1 OR 28.4.9
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:premium:wordpress:*:* 1 OR 38.4.9
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:enterprise:wordpress:*:* 1 OR 48.4.9
References
Reference URL Reference Tags
https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7 Exploit Third Party Advisory
https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c Exploit Third Party Advisory
https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b Exploit Third Party Advisory
https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb Exploit Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-1092
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1092
History
Created Old Value New Value Data Type Notes
2023-04-17 03:32:41 Added to TrackCVE
2023-04-17 03:32:44 Weakness Enumeration new