CyberSecBulletin
CVE-2023-2982NVD status: Modified

miniOrange Social Login and Register (Discord…: Authentication Bypass Using an Alternate Path or Channel

Published Updated By the CyberSecBulletin desk

CVE-2023-2982 is a critical-severity authentication bypass using an alternate path or channel vulnerability in miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) from Cyberlord92, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) versions: 7.6.4 and earlier. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 46.2% chance of exploitation within 30 days, which is in the top 1.17% of all scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Wordpress Social Login And Register (discord, Google, Twitter, Linkedin) to 7.6.5 or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Cyberlord92miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)7.6.4 and earlierNot stated
MiniorangeWordpress Social Login And Register (discord, Google, Twitter, Linkedin)before 7.6.57.6.5

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (wordfence.com).

Official description

The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How developers prevent this class of flaw

  • Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

More Authentication Bypass Using an Alternate Path or Channel vulnerabilities (CWE-288)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

All miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) vulnerabilities

Recent Authentication Bypass Using an Alternate Path or Channel vulnerabilities

Spotted an error? Tell us.