CVE-2022-2133: OAuth Single Sign On < 6.22.6 - Authentication Bypass
Published Jul 17, 2022
·Updated
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
Affected Software
1 affected component
miniOrange Oauth Single Sign On Wordpress<6.22.6
Event History
Jul 17, 2022
CVE Published
via MITRE·10:36 AM
Data Sourced
via MITRE·10:36 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-2133.
2
What is the severity of CVE-2022-2133?
The severity of CVE-2022-2133 is medium with a severity value of 5.3.
3
What is affected by CVE-2022-2133?
The OAuth Single Sign On WordPress plugin before version 6.22.6 is affected by CVE-2022-2133.
4
How does CVE-2022-2133 impact the site?
CVE-2022-2133 allows attackers to log onto the site with just the knowledge of a user's email address.
5
How can I fix CVE-2022-2133?
To fix CVE-2022-2133, it is recommended to update the OAuth Single Sign On WordPress plugin to version 6.22.6 or higher.