OAuth Single Sign On < 6.22.6 - Authentication Bypass
CVE-2022-2133

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Oauth Single Sign On – Sso (oauth Client)
Vendor
CVE Published:
17 July 2022

Summary

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

Affected Version(s)

OAuth Single Sign On – SSO (OAuth Client) 6.22.6

References

https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lana Codes
.