CVE-2020-6850

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php

published February 17, 2020

CVSS
—
EPSS
1%
Percentile
71.8
In the wild
Unconfirmed
What it is

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01376 · 71.8th percentile
Published
2020-02-17T15:01Z
EPSS history
Timeline
  • 17 FEB 15:01Z
    Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php
    cvelistv5