miniOrange Vulnerabilities and Affected Products
Vulnerabilities associated with miniOrange WordPress SAML SSO Premium MulsiteSite.
Products
Clear product- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)5 vulnerabilities
- miniorange otp verification4 vulnerabilities
- WordPress Social Login and Register3 vulnerabilities
- Custom API for WP2 vulnerabilities
- Headless Single Sign On2 vulnerabilities
- Malware Scanner2 vulnerabilities
- miniOrange Discord Integration2 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)2 vulnerabilities
- otp_verification2 vulnerabilities
- SAML SP Single Sign On2 vulnerabilities
- web_application_firewall2 vulnerabilities
- wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\)2 vulnerabilities
- Backup and Restore1 vulnerability
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login1 vulnerability
- Malware Scanner plugin and Web Application Firewall plugin for WordPress1 vulnerability
- malware_scanner1 vulnerability
- miniOrange WordPress SAML SSO Premium1 vulnerability
- miniOrange WordPress SAML SSO Premium MulsiteSite1 vulnerability
- miniOrange WordPress SAML SSO Standard1 vulnerability
- miniOrange's Google Authenticator1 vulnerability
- miniOrange's Google Authenticator (WordPress plugin)1 vulnerability
- miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login1 vulnerability
- OAuth 2.0 client for SSO (WordPress plugin)1 vulnerability
- OAuth Single Sign On Enterprise1 vulnerability
- OAuth Single Sign On Free1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-4496MEDIUM | miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO loginThe SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in. CWE-601Jan 30, 2023 | CVSS6.1v3.1 | EPSS0.61% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |