CVEDB API

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.007

EPSS Ranking 70.7%

CVSS Severity

CVSS v3 Score 7.5

CVSS v2 Score 5.0

References

Products affected by CVE-2016-10928

Onelogin » Onelogin Saml Sso » Version: 1.0.0

cpe:2.3:a:onelogin:onelogin_saml_sso:1.0.0
Onelogin » Onelogin Saml Sso » Version: 1.0.1

cpe:2.3:a:onelogin:onelogin_saml_sso:1.0.1
Onelogin » Onelogin Saml Sso » Version: 2.0.0

cpe:2.3:a:onelogin:onelogin_saml_sso:2.0.0
Onelogin » Onelogin Saml Sso » Version: 2.1.0

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.0
Onelogin » Onelogin Saml Sso » Version: 2.1.1

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.1
Onelogin » Onelogin Saml Sso » Version: 2.1.2

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.2
Onelogin » Onelogin Saml Sso » Version: 2.1.3

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.3
Onelogin » Onelogin Saml Sso » Version: 2.1.4

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.4
Onelogin » Onelogin Saml Sso » Version: 2.1.5

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.5
Onelogin » Onelogin Saml Sso » Version: 2.1.6

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.6
Onelogin » Onelogin Saml Sso » Version: 2.1.7

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.7
Onelogin » Onelogin Saml Sso » Version: 2.1.8

cpe:2.3:a:onelogin:onelogin_saml_sso:2.1.8