Lucene search
HistoryMar 27, 2023 - 4:15 p.m.
CVE-2023-1093
oauth
single sign on
csrf
wordpress
identify providers
cve-2023-1093
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
29.9%
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
Affected configurations
Node
miniorangeoauth_single_sign_onRange<6.24.2wordpress
Related
cvelist
cvelist
cve
cve
CVE-2023-1093
2023-03-27 16:15:09
wpvulndb
wpvulndb
OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF
2023-02-28 00:00:00
wpexploit
wpexploit
OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF
2023-02-28 00:00:00
prion
prion
Cross site request forgery (csrf)
2023-03-27 16:15:00
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
29.9%
Related for NVD:CVE-2023-1093