Strategic Overview
- Status
- Patched in 2.2.0
- Affected Plugin
- OneLogin SAML SSO
- Affected Version
< 2.2.0- CVSS
- 7.5High
- Weakness type
- CWE-798 · Use of Hard-coded Credentials
- CVE
CVE-2016-10928
At a glance
CVE-2016-10928 is a high-severity Use of Hard-coded Credentials vulnerability in the OneLogin SAML SSO WordPress plugin, affecting versions < 2.2.0. It carries a CVSS score of 7.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 2.2.0; sites on affected versions should update now. Disclosed January 2016, reported by Jouko Pynnöne.
Vulnerability Overview
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.
CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Remediation
Update to version 2.2.0, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: OneLogin SAML SSO 2.2.0 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C