CVE-2022-3907: Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure
Published Dec 5, 2022
·Updated
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.
Affected Software
2 affected components
Clerk Clerk.io Wordpress<4.0.0
Clerk.io Clerk.io Wordpress<4.0.0
Event History
Dec 5, 2022
CVE Published
via MITRE·04:50 PM
Data Sourced
via MITRE·04:50 PM
DescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-3907?
CVE-2022-3907 has been assigned a medium severity rating due to its potential for time-based attacks on API key validation.
2
How do I fix CVE-2022-3907?
The recommended fix for CVE-2022-3907 is to update the Clerk WordPress plugin to version 4.0.0 or later.
3
What types of attacks are associated with CVE-2022-3907?
CVE-2022-3907 is associated with time-based attacks that exploit the API key validation process.
4
Who is affected by CVE-2022-3907?
Users of the Clerk WordPress plugin prior to version 4.0.0 are affected by CVE-2022-3907.
5
What versions of the Clerk plugin are vulnerable to CVE-2022-3907?
All versions of the Clerk WordPress plugin prior to 4.0.0 are vulnerable to CVE-2022-3907.