CVE-2023-1093 OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF

2023-03-2715:37:22

WPScan

www.cve.org

cve-2023-1093

wordpress

csrf

oauth client

identify providers

0.001 Low

EPSS

Percentile

29.9%

JSON

The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "OAuth Single Sign On",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "6.24.2"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d

0.001 Low

EPSS

Percentile

29.9%

JSON

Related for CVELIST:CVE-2023-1093