Описание
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.4.2 (исключая)
cpe:2.3:a:wp-oauth:wp_oauth_server:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 22%
0.00074
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-352
Связанные уязвимости
CVSS3: 6.5
github
около 3 лет назад
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
EPSS
Процентиль: 22%
0.00074
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-352