Lucene search

CVE-2022-3907

🗓️ 05 Dec 2022 17:10:15Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 6
NVD	CVE-2022-3907	5 Dec 202217:15	–	nvd
Prion	Cross site scripting	5 Dec 202217:15	–	prion
Patchstack	WordPress Clerk plugin <= 3.8.2 - Auth. Bypass and API Keys Disclosure vulnerability	10 Nov 202200:00	–	patchstack
WPVulnDB	Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure	10 Nov 202200:00	–	wpvulndb
wpexploit	Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure	10 Nov 202200:00	–	wpexploit
Cvelist	CVE-2022-3907 Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure	5 Dec 202216:50	–	cvelist

Nvd

Vulners

Node

clerk clerk.ioRange<4.0.0wordpress

[
  {
    "vendor": "Unknown",
    "product": "Clerk",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.0.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7920c1c1-709d-4b1f-ac08-f0a02ddb329c

Parameter	Position	Path	Description	CWE
key	query param	/wp-json/clerk/getconfig	The endpoint allows API key validation which is vulnerable to time-based attacks due to usage of comparison operators.	CWE-203
private_key	query param	/wp-json/clerk/getconfig	The endpoint allows API key validation which is vulnerable to time-based attacks due to usage of comparison operators.	CWE-203

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

05 Dec 2022 17:15Current

7.4High risk

Vulners AI Score7.4

CVSS37.5

EPSS0.0025

CWE-203