CVE-2022-0229
miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
- State
- Published
- Severity
- Not scored
- Published
- Mar 21, 2022
- Updated
- Aug 2, 2024
- Reserved
- Jan 14, 2022
Description
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
miniOrange's Google AuthenticatorUnknown |
|
References
- https://wpscan.com/vulnerability/d70c5335-4c01-448d-85fc-f8e75b104351exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.