Read the docs

miniOrange

Records129All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical28CVSS 9.0–10.0
CVSS high39CVSS 7.0–8.9

Exploited now

miniOrange records in CISA KEV

No miniOrange vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Active Directory Integration / Ldap Integration 6 records HIGH Google Authenticator 6 records MEDIUM Miniorange 2fa 6 records LOW Oauth Single Sign On 4 records HIGH Saml Sp Single Sign On 3 records LOW Wordpress Social Login And Register (discord, Google, Twitter, Linkedin) 3 records HIGH Malware Scanner 2 records LOW Otp Verification With Firebase 2 records MEDIUM

Records

4 records in Oauth Single Sign On · all components

TI-2022-15071 CVE-2022-34155 · GHSA-8xq7-32f2-8w8h

WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication

Priority HIGH 73

Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00958 Published 2023-07-18 No fix listed CWE-287
TI-2023-01035 CVE-2023-1093 · GHSA-p9cv-6fpg-m4jw

OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF

Priority MEDIUM 62

The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00326 Published 2023-03-27 Fixed in 6.24.2
TI-2023-01034 CVE-2023-1092 · GHSA-pcjh-54m8-fqfm

OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

Priority MEDIUM 62

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00442 Published 2023-03-27 Fixed in 6.24.2, 28.4.9 +2
TI-2022-01974 CVE-2022-2133 · GHSA-c6gx-cr5g-7jhp

OAuth Single Sign On < 6.22.6 - Authentication Bypass

Priority LOW 26

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01213 Published 2022-07-17 Fixed in 6.22.6 CWE-287
Open these records in search →