CVE-2016-10928

OneLogin SAML SSO < 2.2.0 - Authentication Bypass

2016-01-21 00:00
Jouko Pynnöne

Strategic Overview

Status
Patched in 2.2.0
Affected Plugin
OneLogin SAML SSO
Affected Version
< 2.2.0
CVSS
7.5High
Weakness type
CWE-798 · Use of Hard-coded Credentials
CVE
CVE-2016-10928
View all OneLogin SAML SSO vulnerabilities

At a glance

CVE-2016-10928 is a high-severity Use of Hard-coded Credentials vulnerability in the OneLogin SAML SSO WordPress plugin, affecting versions < 2.2.0. It carries a CVSS score of 7.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 2.2.0; sites on affected versions should update now. Disclosed January 2016, reported by Jouko Pynnöne.

Vulnerability Overview

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-798: Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Remediation

Update to version 2.2.0, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: OneLogin SAML SSO 2.2.0 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C