ID CVE-2024-23771
Summary darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
References
Vulnerable Configurations
  • cpe:2.3:a:unix4lyfe:darkhttpd:-:*:*:*:*:*:*:*
    cpe:2.3:a:unix4lyfe:darkhttpd:-:*:*:*:*:*:*:*
  • cpe:2.3:a:unix4lyfe:darkhttpd:1.13:*:*:*:*:*:*:*
    cpe:2.3:a:unix4lyfe:darkhttpd:1.13:*:*:*:*:*:*:*
  • cpe:2.3:a:unix4lyfe:darkhttpd:1.13-1:*:*:*:*:*:*:*
    cpe:2.3:a:unix4lyfe:darkhttpd:1.13-1:*:*:*:*:*:*:*
  • cpe:2.3:a:unix4lyfe:darkhttpd:1.14:*:*:*:*:*:*:*
    cpe:2.3:a:unix4lyfe:darkhttpd:1.14:*:*:*:*:*:*:*
  • cpe:2.3:a:unix4lyfe:darkhttpd:1.15:*:*:*:*:*:*:*
    cpe:2.3:a:unix4lyfe:darkhttpd:1.15:*:*:*:*:*:*:*
CVSS
Base: None
Impact:
Exploitability:
CWE CWE-203
CAPEC
Access
VectorComplexityAuthentication
Impact
ConfidentialityIntegrityAvailability
Last major update 26-01-2024 - 19:24
Published 22-01-2024 - 04:15
Last modified 26-01-2024 - 19:24
Back to Top