Lucene search
HistoryMar 27, 2023 - 4:15 p.m.
CVE-2023-1093
oauth
single sign on
csrf
wordpress
identify providers
cve-2023-1093
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
33.2%
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
Affected configurations
Node
miniorangeoauth_single_sign_onRange<6.24.2wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| miniorange | oauth_single_sign_on | * | cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:*:wordpress:*:* |
Related
cve
cve
CVE-2023-1093
2023-03-27 16:15:09
cvelist
cvelist
wpvulndb
wpvulndb
OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF
2023-02-28 00:00:00
prion
prion
Cross site request forgery (csrf)
2023-03-27 16:15:00
wpexploit
wpexploit
OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF
2023-02-28 00:00:00
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
33.2%
Related for NVD:CVE-2023-1093