Unrated severityNVD Advisory· Published Jan 25, 2022· Updated Aug 4, 2024
CVE-2021-43298
CVE-2021-43298
Description
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
Affected products
2Patches
Vulnerability mechanics
References
1- github.com/embedthis/goahead/issues/304mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.