CVE-2022-4496

CVE-2022-4496: miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login

Vendor Miniorange
Product miniOrange WordPress SAML SSO Standard
Published January 30, 2023
Last update March 28, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.

Key dates

02Disclosure timeline

January 30, 2023 CVE published
March 28, 2025 Record updated