PT-2022-13048 · Miniorange · Google Authenticator Wordpress Plugin

Krzysztof Zając · Published 2022-03-21 · Updated 2023-08-02 · CVE-2022-0229

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions miniOrange's Google Authenticator WordPress plugin versions prior to 5.5

Description The issue arises from the lack of proper authorization and CSRF checks when handling the reconfigureMethod, and improper validation of parameters passed to it. This allows unauthenticated users to delete arbitrary options from the blog, rendering it unusable.

Recommendations For versions prior to 5.5, update to version 5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the reconfigureMethod to prevent unauthorized modifications until a patch is applied.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2022-0229

Affected Products

Google Authenticator Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/d70c5335-4c01-448d-85fc-f8e75b104351 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0229 · Security Note
• https://t.me/cibsecurity/39335 · Telegram Post
• https://t.me/cvenotify/55006 · Telegram Post