CVE-2022-4496

miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login

State: Published
Severity: 6.1 Medium
Published: Jan 30, 2023
Updated: Mar 28, 2025
Reserved: Dec 14, 2022

Description

The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
miniOrange WordPress SAML SSO StandardminiOrange	16.0.0 to before 16.0.8Affected
miniOrange WordPress SAML SSO PremiumminiOrange	12.0.0 to before 12.1.0Affected
miniOrange WordPress SAML SSO Premium MulsiteSiteminiOrange	20.0.0 to before 20.0.7Affected

References

https://wpscan.com/vulnerability/af2e30c7-0787-4fe2-97ee-bc616f7178a1exploitvdb-entrytechnical-description
https://wpscan.com/vulnerability/be21f355-0e5b-4ad7-9d8f-85e9a0101ddcexploitvdb-entrytechnical-description
https://wpscan.com/vulnerability/e6c4c8c7-1dcd-45bf-8582-f12accca6facexploitvdb-entrytechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.