CVE-2023-1092

Public Exploit

OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

Description

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

6.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.13%

Third-Party Advisory wpscan.com Third-Party Advisory wpscan.com Third-Party Advisory wpscan.com Third-Party Advisory wpscan.com

Affected: MiniOrange OAuth Single Sign On Free

Affected: MiniOrange OAuth Single Sign On Standard

Affected: MiniOrange OAuth Single Sign On Premium

Affected: MiniOrange OAuth Single Sign On Enterprise

References

Link	Tags
https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b	third party advisory vdb entry exploit technical description
https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb	third party advisory vdb entry exploit technical description
https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7	third party advisory vdb entry exploit technical description
https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c	third party advisory vdb entry exploit technical description

Frequently Asked Questions

What is the severity of CVE-2023-1092?: CVE-2023-1092 has been scored as a medium severity vulnerability.
How to fix CVE-2023-1092?: To fix CVE-2023-1092, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-1092 being actively exploited in the wild?: It is possible that CVE-2023-1092 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-1092?: CVE-2023-1092 affects MiniOrange OAuth Single Sign On Free, MiniOrange OAuth Single Sign On Standard, MiniOrange OAuth Single Sign On Premium, MiniOrange OAuth Single Sign On Enterprise.