Medium severity · published Jan 30, 2023
CVE-2022-4496
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin…
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Saml SP Single Sign ON · Miniorange
12.0.0 before 12.1.0; 16.0.0 before 16.0.8; 20.0.0 before 20.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4496
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4496
Third Party Advisory
https://wpscan.com/vulnerability/af2e30c7-0787-4fe2-97ee-bc616f7178a1
Third Party Advisory
https://wpscan.com/vulnerability/be21f355-0e5b-4ad7-9d8f-85e9a0101ddc
Third Party Advisory
https://wpscan.com/vulnerability/e6c4c8c7-1dcd-45bf-8582-f12accca6fac
More from Saml SP Single Sign ON
8.1
CVE-2026-61979
WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability
6.1
CVE-2020-6850
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php
6.1
CVE-2019-12346
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post