CVE-2022-42461

2022-11-1820:15:09

CWE-264

[email protected]

web.nvd.nist.gov

cve

2022

42461

broken access control

miniorange

google authenticator plugin

wordpress

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.9%

JSON

Broken Access Control vulnerability in miniOrange’s Google Authenticator plugin <= 5.6.1 on WordPress.

Affected configurations

Vulners

NVD

Node

miniorangegoogle_authenticatorRange≤5.6.1

VendorProductVersionCPE
miniorangegoogle_authenticator*cpe:2.3:a:miniorange:google_authenticator:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
miniorange	google_authenticator	*	cpe:2.3:a:miniorange:google_authenticator::::::::

CNA Affected

[
  {
    "vendor": "miniOrange",
    "product": "miniOrange's Google Authenticator (WordPress plugin)",
    "versions": [
      {
        "version": "<= 5.6.1",
        "status": "affected",
        "lessThanOrEqual": "5.6.1",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/miniorange-2-factor-authentication/wordpress-miniorange-s-google-authenticator-plugin-5-6-1-broken-access-control-vulnerability?_s_id=cve