The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/af2e30c7-0787-4fe2-97ee-bc616f7178a1 | Third Party Advisory |
| https://wpscan.com/vulnerability/be21f355-0e5b-4ad7-9d8f-85e9a0101ddc | Third Party Advisory |
| https://wpscan.com/vulnerability/e6c4c8c7-1dcd-45bf-8582-f12accca6fac | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:57
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
07 Feb 2023, 17:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wpscan.com/vulnerability/be21f355-0e5b-4ad7-9d8f-85e9a0101ddc - Third Party Advisory | |
| References | (MISC) https://wpscan.com/vulnerability/af2e30c7-0787-4fe2-97ee-bc616f7178a1 - Third Party Advisory | |
| References | (MISC) https://wpscan.com/vulnerability/e6c4c8c7-1dcd-45bf-8582-f12accca6fac - Third Party Advisory | |
| First Time |
Miniorange
Miniorange saml Sp Single Sign On |
|
| CPE | cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:multisite:wordpress:*:* cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:standard:wordpress:*:* cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:premium:wordpress:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
30 Jan 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-30 21:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-4496
Mitre link : CVE-2022-4496
CVE.ORG link : CVE-2022-4496
JSON object : View
Products Affected
miniorange
- saml_sp_single_sign_on
CWE
No CWE.