Microsoft Office 365

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

low complexity

wpo365

NVD

Published: 2020-10-02

Updated: 2021-07-21

Summary

The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.

Vulnerable Configurations

Part	Description	Count
Application	Wpo365 Wpo365 Wordpress + Azure AD / Microsoft Office 365 - Wpo365 Wordpress + Azure AD / Microsoft Office 365 3.10 Wpo365 Wordpress + Azure AD / Microsoft Office 365 3.11 Wpo365 Wordpress + Azure AD / Microsoft Office 365 3.12 Wpo365 Wordpress + Azure AD / Microsoft Office 365 3.13 Wpo365 Wordpress + Azure AD / Microsoft Office 365 4.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 5.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 5.1 Wpo365 Wordpress + Azure AD / Microsoft Office 365 5.2 Wpo365 Wordpress + Azure AD / Microsoft Office 365 5.3 Wpo365 Wordpress + Azure AD / Microsoft Office 365 6.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 6.1 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.1 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.2 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.3 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.4 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.5 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.6 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.7 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.8 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.9 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.10 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.11 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.12 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.13 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.14 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.15 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.16 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.17 Wpo365 Wordpress + Azure AD / Microsoft Office 365 7.18 Wpo365 Wordpress + Azure AD / Microsoft Office 365 8.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 8.1 Wpo365 Wordpress + Azure AD / Microsoft Office 365 8.2 Wpo365 Wordpress + Azure AD / Microsoft Office 365 8.3 Wpo365 Wordpress + Azure AD / Microsoft Office 365 8.4 Wpo365 Wordpress + Azure AD / Microsoft Office 365 8.5 Wpo365 Wordpress + Azure AD / Microsoft Office 365 8.6 Wpo365 Wordpress + Azure AD / Microsoft Office 365 9.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 9.1 Wpo365 Wordpress + Azure AD / Microsoft Office 365 9.2 Wpo365 Wordpress + Azure AD / Microsoft Office 365 9.3 Wpo365 Wordpress + Azure AD / Microsoft Office 365 9.4 Wpo365 Wordpress + Azure AD / Microsoft Office 365 9.5 Wpo365 Wordpress + Azure AD / Microsoft Office 365 9.6 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.1 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.2 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.3 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.4 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.5 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.6 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.7 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.8 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.9 Wpo365 Wordpress + Azure AD / Microsoft Office 365 10.10 Wpo365 Wordpress + Azure AD / Microsoft Office 365 11.0 Wpo365 Wordpress + Azure AD / Microsoft Office 365 11.1 Wpo365 Wordpress + Azure AD / Microsoft Office 365 11.2 Wpo365 Wordpress + Azure AD / Microsoft Office 365 11.3 Wpo365 Wordpress + Azure AD / Microsoft Office 365 11.4 Wpo365 Wordpress + Azure AD / Microsoft Office 365 11.5 Wpo365 Wordpress + Azure AD / Microsoft Office 365 11.6	63

Summary

Vulnerable Configurations

References