1. Home
  2. CVE Database
  3. CVE-2022-2133
MEDIUM · 5.3

CVE-2022-2133

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user'...

Vulnerability Description

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
MiniorangeOauth Single Sign On< 6.22.6

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2022-2133?

CVE-2022-2133 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user'...

How severe is CVE-2022-2133?

CVE-2022-2133 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-2133?

Check the references section above for vendor advisories and patch information. Affected products include: Miniorange Oauth Single Sign On.