WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
99Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.8epss 46%
da publicação à arma0 dias
Publicada no NVD29 de jun.
1ª PoC29 de jun.
VulnCheck+172d
probabilidade de exploração
46%top 1% das CVEs
exploração observada
simVulnCheck
8 exploit(s) público(s)
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
cyberlord92 · miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)PoCs públicas encontradas — 8
githubgithub.com/RandomRobbieBF/CVE-2023-2982★ 82githubgithub.com/H4K6/CVE-2023-2982-POC★ 9githubgithub.com/LoaiEsam37/CVE-2023-2982★ 0githubgithub.com/wshinkle/CVE-2023-2982★ 0vulncheckvulncheck.com/xdb/d4246bb421eenão verificadovulncheckvulncheck.com/xdb/313cf37c648anão verificadovulncheckvulncheck.com/xdb/e78e92f8cc61não verificadovulncheckvulncheck.com/xdb/af482cca0b29não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openidhttps://plugins.trac.wordpress.org/changeset/2925914/miniorange-login-openidhttps://www.wordfence.com/threat-intel/vulnerabilities/id/08ca186a-2486-4a58-9c53-03e9eba13e66?source=cve