Lucene search

[email protected]NVD:CVE-2019-12346

HistoryJun 24, 2019 - 9:15 p.m.

CVE-2019-12346

2019-06-2421:15:12

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.7%

JSON

In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.

Affected configurations

Nvd

Node

miniorangesaml_sp_single_sign_onRange<4.8.73wordpress

VendorProductVersionCPE
miniorangesaml_sp_single_sign_on*cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
miniorange	saml_sp_single_sign_on	*	cpe:2.3:a:miniorange:saml_sp_single_sign_on::::::wordpress::*

References

wpvulndb.com/vulnerabilities/9397

zeroauth.ltd/blog/2019/05/27/cve-2019-12346-miniorange-saml-sp-single-sign-on-wordpress-plugin-xss/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.7%

JSON

Related for NVD:CVE-2019-12346

openvas1 cvelist1 wpvulndb1 cve1 prion1