CVE-2021-43298: embedthis goahead Observable Timing Discrepancy
Vulnerability summary
CVE-2021-43298 is a critical (CVSS 9.8) Observable Timing Discrepancy vulnerability in embedthis goahead. EPSS estimates a 2.26% chance of exploitation in the next 30 days, higher than 82.6% of scored vulnerabilities.
Timeline
- 25-01-2022PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.26%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-307Improper Restriction of Excessive Authentication AttemptsThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Affected systems
Embedthis1 product
- goahead≥ unspecified, < 5.1.4 | < 5.1.4
1 vendor · 1 product