{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-4496",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-4496",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2023-01-30T20:31:36.908Z",
    "updatedAt": "2025-03-28T14:03:32.744Z",
    "importedAt": "2026-10-24T01:56:49.724Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login",
      "summary": "The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.",
      "affected": [
        {
          "vendor": "miniOrange",
          "product": "miniOrange WordPress SAML SSO Standard",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "16.0.0",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "16.0.8"
            }
          ]
        },
        {
          "vendor": "miniOrange",
          "product": "miniOrange WordPress SAML SSO Premium",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "12.0.0",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "12.1.0"
            }
          ]
        },
        {
          "vendor": "miniOrange",
          "product": "miniOrange WordPress SAML SSO Premium MulsiteSite",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "20.0.0",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "20.0.7"
            }
          ]
        }
      ]
    }
  }
}