CVE-2022-3119

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/55b83cee-a8a5-4f9d-a976-a3eed9a558e5	Exploit Third Party Advisory
https://wpscan.com/vulnerability/55b83cee-a8a5-4f9d-a976-a3eed9a558e5	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oauth_client_single_sign_on_project:oauth_client_single_sign_on:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 07:18

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/55b83cee-a8a5-4f9d-a976-a3eed9a558e5 - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/55b83cee-a8a5-4f9d-a976-a3eed9a558e5 - Exploit, Third Party Advisory

Information

Published : 2022-09-26 13:15

Updated : 2024-11-21 07:18

NVD link : CVE-2022-3119

Mitre link : CVE-2022-3119

CVE.ORG link : CVE-2022-3119

JSON object : View

Products Affected

oauth_client_single_sign_on_project

oauth_client_single_sign_on

CWE

CWE-287

Improper Authentication

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-3119", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-09-26T13:15:11.217", "references": [{"url": "https://wpscan.com/vulnerability/55b83cee-a8a5-4f9d-a976-a3eed9a558e5", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/55b83cee-a8a5-4f9d-a976-a3eed9a558e5", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address"}, {"lang": "es", "value": "El cliente OAuth Single Sign On plugin de WordPress versiones anteriores a 3.0.4, no presenta autorizaci\u00f3n y de tipo CSRF cuando es actualizada su configuraci\u00f3n, lo que podr\u00eda permitir a atacantes no autenticados actualizarlos y cambiar los endpoints OAuth a los que ellos controlan, permiti\u00e9ndoles entonces ser autenticados como admin si conocen la direcci\u00f3n de correo electr\u00f3nico correcta"}], "lastModified": "2024-11-21T07:18:51.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oauth_client_single_sign_on_project:oauth_client_single_sign_on:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "D4A3C3FD-DA5A-4BF2-8746-066A5AAF7754", "versionEndExcluding": "3.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}