CRITICAL🇵🇱 Wersja polska

CVE-2021-41615

CVSS 9.8v3.1pub. 2022-08-08upd. 2024-11-21

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Embedthis Goahead

    APP
    Embedthis
    2.1.8
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-43298CRITICAL9.8PL ✓same product

Embedthis GoAhead: brute-force hasła HTTP Basic Auth przez timing attack

CVE-2021-42342CRITICAL9.8PL ✓same product

GoAhead: tunelowanie zmiennych środowiskowych do skryptów CGI przez upload pliku

CVE-2019-5096CRITICAL9.8PL ✓same product

GoAhead Web Server: RCE przez use-after-free w obsłudze multipart/form-data

CVE-2017-1000471CRITICAL9.8PL ✓same product

NULL pointer dereference w obsłudze CGI serwera EmbedThis GoAhead 4.0.0

CVE-2017-5674CRITICAL9.8PL ✓same product

Ujawnienie hasła konfiguracyjnego w kamerach IP przez GoAhead