Actu
Vigil@nce - WordPress OneLogin SAML SSO: constant passwords
August 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use the local accounts created by WordPress
OneLogin SAML SSO, in order to escalate his privileges.
Impacted products: WordPress Plugins not comprehensive.
Severity: 2/4.
Creation date: 06/06/2016.
DESCRIPTION OF THE VULNERABILITY
The OneLogin SAML SSO plugin can be installed on WordPress.
It can automatically create local accounts for users approuved by
the SSO system. However, the passwords for these local accounts is
hard coded. So any user can known it.
An attacker can therefore use the local accounts created by
WordPress OneLogin SAML SSO, in order to escalate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/WordPress-OneLogin-SAML-SSO-constant-passwords-19807
