CVE-2023-1092: OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF
First published: Mon Mar 27 2023(Updated: )
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MiniOrange OAuth 2.0 Client for SSO | <6.24.2 | |
| MiniOrange OAuth 2.0 Client for SSO | <28.4.9 | |
| MiniOrange OAuth 2.0 Client for SSO | <38.4.9 | |
| MiniOrange OAuth 2.0 Client for SSO | <48.4.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-1092.
What is the severity of CVE-2023-1092?
The severity of CVE-2023-1092 is medium with a severity value of 6.5.
Which plugins are affected by CVE-2023-1092?
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9, and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 are affected by CVE-2023-1092.
What is the vulnerability description for CVE-2023-1092?
CVE-2023-1092 is a vulnerability in the OAuth Single Sign On plugins for WordPress that allows an attacker to delete Identity Providers without CSRF checks.
How can I fix CVE-2023-1092?
To fix CVE-2023-1092, update the OAuth Single Sign On Free WordPress plugin to version 6.24.2 or higher, OAuth Single Sign On Standard WordPress plugin to version 28.4.9 or higher, OAuth Single Sign On Premium WordPress plugin to version 38.4.9 or higher, and OAuth Single Sign On Enterprise WordPress plugin to version 48.4.9 or higher.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/title
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/miniorange
- canonical/miniorange oauth 2.0 client for sso