WPO365 LOGINに認証回避の脆弱性、45.2で修正
Summary
WordPressのMicrosoft連携プラグインWPO365 LOGINに、盗まれたSAML応答の再送で管理者を含む他人としてログインされる脆弱性があります。SAMLログインを使うサイトは、版を確認して修正版に更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressのMicrosoft連携プラグインWPO365 LOGINに、盗まれたSAML応答の再送で管理者を含む他人としてログインされる脆弱性があります。SAMLログインを使うサイトは、版を確認して修正版に更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| wpo365 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) |
< 45.2 |
45.2 |
Original description The description as published by the source.
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory