CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.
Explanation of Vulnerability in Simple Terms
The SAML SP Single Sign On plugin for miniOrange versions up to 5.0.4 fails to properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify settings or data they should not have access to. The vulnerability does not expose sensitive information or crash the site, but it does allow unauthorized changes to plugin configuration.
What an attacker can do
A logged-in user can modify plugin settings or data without proper authorization.
Potential impact on your site
Unauthorized users may alter SAML authentication settings, potentially disrupting login flows or compromising SSO configuration.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
