CVE-2021-43298

Katalog CVE

CVSS 9.8 · Critical EPSS 2,3%

Kerentanan Observable Timing Discrepancy pada embedthis goahead. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.

Rincian

Terbit di NVD

25 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy
CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/embedthis/goahead/issues/304 advisory pihak ketiga