CVE-2022-3907

Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure

High · published December 5, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00944 · 60.7th percentile
Published
2022-12-05T16:50Z
EPSS history
Timeline
  • 05 DEC 16:50Z
    Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure
    cvelistv5