CVE-2023-1092

🗓️ 27 Mar 2023 15:39:36Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 61 Views🌐 WEB

Plugin vulnerabilities allowing CSRF attack for WordPress OAuth Single Sign O

Reporter	Title	Published	Views	Family All 19
CNNVD	WordPress plugin OAuth Single Sign On Free 跨站请求伪造漏洞	27 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-1092 OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF	27 Mar 202315:39	–	cvelist
EUVD	EUVD-2023-23379	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1092	27 Mar 202316:15	–	nvd
OSV	CVE-2023-1092	27 Mar 202316:15	–	osv
Patchstack	WordPress OAuth Single Sign On - SSO (OAuth Client) Premium Plugin < 38.4.9 is vulnerable to Cross Site Request Forgery (CSRF)	28 Mar 202300:00	–	patchstack
Prion	Cross site request forgery (csrf)	27 Mar 202316:15	–	prion
Positive Technologies	PT-2023-16747 · WordPress · Oauth Single Sign On Free +3	27 Mar 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-1092	23 May 202502:34	–	redhatcve
Vulnrichment	CVE-2023-1092 OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF	27 Mar 202315:39	–	vulnrichment

NVD

Vulners

Node

miniorange oauth_single_sign_onRange<6.24.2freewordpress

miniorange oauth_single_sign_onRange<28.4.9standardwordpress

miniorange oauth_single_sign_onRange<38.4.9premiumwordpress

miniorange oauth_single_sign_onRange<48.4.9enterprisewordpress

[
  {
    "vendor": "MiniOrange",
    "product": "OAuth Single Sign On Free",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "6.24.2"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  },
  {
    "vendor": "MiniOrange",
    "product": "OAuth Single Sign On Standard",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "28.4.9"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "MiniOrange",
    "product": "OAuth Single Sign On Premium",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "38.4.9"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "MiniOrange",
    "product": "OAuth Single Sign On Enterprise",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "48.4.9"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7
wpscan	www.wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb
wpscan	www.wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c
wpscan	www.wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b

Parameter	Position	Path	Description	CWE
page	query param	wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=delete&app=wordpress	CSRF vulnerability allowing admin to delete Identity Providers via crafted request	CWE-352
tab	query param	wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=delete&app=wordpress	CSRF vulnerability allowing admin to delete Identity Providers via crafted request	CWE-352
action	query param	wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=delete&app=wordpress	CSRF vulnerability allowing admin to delete Identity Providers via crafted request	CWE-352
app	query param	wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=delete&app=wordpress	CSRF vulnerability allowing admin to delete Identity Providers via crafted request	CWE-352

19 Feb 2025 17:15Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.5

EPSS0.00163

SSVC