PT-2023-16747 · WordPress · Oauth Single Sign On Free+3

Nguyen Thuc Tuyen · Publicado 2023-03-27 · Atualizado 2023-04-03 · CVE-2023-1092

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OAuth Single Sign On Free WordPress plugin versions prior to 6.24.2 OAuth Single Sign On Standard WordPress plugin versions prior to 28.4.9 OAuth Single Sign On Premium WordPress plugin versions prior to 38.4.9 OAuth Single Sign On Enterprise WordPress plugin versions prior to 48.4.9

Description The issue concerns a lack of CSRF checks when deleting Identity Providers (IdP) in the OAuth Single Sign On WordPress plugins. This could allow attackers to make logged-in admins delete arbitrary IdP via a CSRF attack.

Recommendations For OAuth Single Sign On Free WordPress plugin versions prior to 6.24.2, update to version 6.24.2 or later. For OAuth Single Sign On Standard WordPress plugin versions prior to 28.4.9, update to version 28.4.9 or later. For OAuth Single Sign On Premium WordPress plugin versions prior to 38.4.9, update to version 38.4.9 or later. For OAuth Single Sign On Enterprise WordPress plugin versions prior to 48.4.9, update to version 48.4.9 or later.

Exploit

Correção

Identificadores relacionados

CVE-2023-1092

Produtos afetados

Oauth Single Sign On Enterprise

Oauth Single Sign On Free

Oauth Single Sign On Premium

Oauth Single Sign On Standard

Referências · 6

• 🔥 https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7 · Exploit
• 🔥 https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb · Exploit
• 🔥 https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c · Exploit
• 🔥 https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b · Exploit
• https://osv.dev/vulnerability/CVE-2023-1092 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1092 · Nota de Segurança