PT-2023-16747 · WordPress · Oauth Single Sign On Free+3

Nguyen Thuc Tuyen · Published 2023-03-27 · Updated 2023-04-03 · CVE-2023-1092

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OAuth Single Sign On Free WordPress plugin versions prior to 6.24.2 OAuth Single Sign On Standard WordPress plugin versions prior to 28.4.9 OAuth Single Sign On Premium WordPress plugin versions prior to 38.4.9 OAuth Single Sign On Enterprise WordPress plugin versions prior to 48.4.9

Description The issue concerns a lack of CSRF checks when deleting Identity Providers (IdP) in the OAuth Single Sign On WordPress plugins. This could allow attackers to make logged-in admins delete arbitrary IdP via a CSRF attack.

Recommendations For OAuth Single Sign On Free WordPress plugin versions prior to 6.24.2, update to version 6.24.2 or later. For OAuth Single Sign On Standard WordPress plugin versions prior to 28.4.9, update to version 28.4.9 or later. For OAuth Single Sign On Premium WordPress plugin versions prior to 38.4.9, update to version 38.4.9 or later. For OAuth Single Sign On Enterprise WordPress plugin versions prior to 48.4.9, update to version 48.4.9 or later.

Exploit

Fix

Related Identifiers

CVE-2023-1092

Affected Products

Oauth Single Sign On Enterprise

Oauth Single Sign On Free

Oauth Single Sign On Premium

Oauth Single Sign On Standard

References · 6

• 🔥 https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7 · Exploit
• 🔥 https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb · Exploit
• 🔥 https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c · Exploit
• 🔥 https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b · Exploit
• https://osv.dev/vulnerability/CVE-2023-1092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1092 · Security Note