CRITICAL🇵🇱 Wersja polska

CVE-2021-43298

CVSS 9.8v3.1pub. 2022-01-25upd. 2024-11-21

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Embedthis Goahead

    APP
    Embedthis
    < 5.1.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-41615CRITICAL9.8PL ✓same product

GoAhead WebServer: niewystarczająca entropia nonce w uwierzytelnianiu HTTP Digest

CVE-2021-42342CRITICAL9.8PL ✓same product

GoAhead: tunelowanie zmiennych środowiskowych do skryptów CGI przez upload pliku

CVE-2019-5096CRITICAL9.8PL ✓same product

GoAhead Web Server: RCE przez use-after-free w obsłudze multipart/form-data

CVE-2017-1000471CRITICAL9.8PL ✓same product

NULL pointer dereference w obsłudze CGI serwera EmbedThis GoAhead 4.0.0

CVE-2017-5674CRITICAL9.8PL ✓same product

Ujawnienie hasła konfiguracyjnego w kamerach IP przez GoAhead