CVE-2022-3691 DeepL Pro API Translation < 1.7.5 - API Key Disclosure
An unauthenticated attacker can access publicly available files to steal the DeepL API key, requiring users to upgrade the plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3691?
CVE-2022-3691 is a high-severity vulnerability in Unknown DeepL Pro API translation plugin, published on 21 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
Weakness: CWE-552
Which versions are affected by CVE-2022-3691?
It affects 1 product.
Products include Fluenx Deepl Pro Api Translation.
How do I fix CVE-2022-3691?
No fix has been published for CVE-2022-3691 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3691 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3691 exists.
Other vulnerabilities in Unknown DeepL Pro API translation plugin
Sources
Also known as GHSA-29rj-95hw-fhm9.