PT-2023-4017 · Miniorange · Miniorange Oauth Single Sign On – Sso

István Márton + 1 · Published 2023-05-24 · Updated 2023-07-27 · CVE-2022-34155

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin versions through 6.23.3

Description The issue is related to an Improper Authentication vulnerability in the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin, which allows Authentication Bypass. This can enable a remote attacker to bypass existing security restrictions.

Recommendations For versions through 6.23.3, update to a version later than 6.23.3 to resolve the issue. As a temporary workaround, consider restricting access to the plugin until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-04315

CVE-2022-34155

Affected Products

Miniorange Oauth Single Sign On – Sso

References · 9

• 🔥 https://lana.codes/lanavdb/071fa6eb-2e54-43a1-b37f-1e562988b7d4?_s_id=cve · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-34155 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34155 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04315 · Security Note
• https://lana.codes/lanavdb/071fa6eb-2e54-43a1-b37f-1e562988b7d4?_s_id=cve%20Exploit · Note
• https://patchstack.com/database/vulnerability/miniorange-login-with-eve-online-google-facebook/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-6-23-3-broken-authentication-vulnerability?_s_id=cve · Note
• https://t.me/cibsecurity/66911 · Telegram Post
• https://t.me/cvenotify/55315 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/miniorange-login-with-eve-online-google-facebook/oauth-single-sign-on-sso-oauth-client-6233-missing-authorization · Note