WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
99Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 46%
de la publicación al arma0 días
Publicada en NVD29 jun
1ª PoC29 jun
VulnCheck+172d
probabilidad de explotación
46%top 1% de las CVE
explotación observada
síVulnCheck
8 exploit(s) público(s)
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
cyberlord92 · miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)PoCs públicas encontradas — 8
githubgithub.com/RandomRobbieBF/CVE-2023-2982★ 82githubgithub.com/H4K6/CVE-2023-2982-POC★ 9githubgithub.com/LoaiEsam37/CVE-2023-2982★ 0githubgithub.com/wshinkle/CVE-2023-2982★ 0vulncheckvulncheck.com/xdb/d4246bb421eeno verificadovulncheckvulncheck.com/xdb/313cf37c648ano verificadovulncheckvulncheck.com/xdb/e78e92f8cc61no verificadovulncheckvulncheck.com/xdb/af482cca0b29no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openidhttps://plugins.trac.wordpress.org/changeset/2925914/miniorange-login-openidhttps://www.wordfence.com/threat-intel/vulnerabilities/id/08ca186a-2486-4a58-9c53-03e9eba13e66?source=cve