QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-43298

Back to search

CVE-2021-43298

Published: Jan 25, 2022

Modified: Aug 4, 2024

PUBLISHED

Description

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.

VendorProductVersions

embedthis

goahead

affected
unspecified - < 5.1.4

Weaknesses (CWE)

CWE-208

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now
CVE-2021-43298 - Security Vulnerability | QwikSec