Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack
2017-04-26 00:00
Scott ArciszewskiStrategic Overview
StatusPatched in 4.2
Affected PluginJetpack – WP Security, Backup, Speed, & Growth
Affected Version
< 4.2CVSS9.8Critical
CVE
N/AVulnerability Overview
The Jetpack plugin for WordPress is vulnerable to timing attacks in versions up to, and including, 4.1.x. This is due to lack of a safe string comparison function.
Technical Analysis
REMEDIATION: Update to version 4.2, or a newer patched version --- IDENTIFIER: CWE-208 (Observable Timing Discrepancy) Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C