Miniorange Oauth Client Extension For Joomla
Monthly
Arbitrary account takeover in the miniOrange OAuth Client extension for Joomla (versions before 3.2.0) lets a remote unauthenticated attacker authenticate as any user, including administrators, by manipulating a single cookie value. The flaw is an authorization/identity check that trusts a client-controlled cookie to establish the logged-in account, so tampering with it grants full session control. No public exploit has been identified at time of analysis, but the trivial network-based vector and CVSS 10.0 rating make it a high-priority patch.
Arbitrary account takeover in the miniOrange OAuth Client extension for Joomla (versions before 3.2.0) lets a remote unauthenticated attacker authenticate as any user, including administrators, by manipulating a single cookie value. The flaw is an authorization/identity check that trusts a client-controlled cookie to establish the logged-in account, so tampering with it grants full session control. No public exploit has been identified at time of analysis, but the trivial network-based vector and CVSS 10.0 rating make it a high-priority patch.