CVE-2022-3119
Assigner: WPScan
Published: 2022-09-26T12:35:44
State: PUBLISHED
affected: product: OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO )
vendor: Unknown
versions: lessThan: 3.0.4
status: affected
version: 3.0.4
versionType: custom
credits: value: Lana Codes
descriptions: value: The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
problemTypes: descriptions: cweId: CWE-287
description: CWE-287 Improper Authentication
type: CWE
descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: EXTERNAL
title: OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass
x_generator: WPScan CVE Generator