Lucene search

[email protected]CVE-2015-7576

HistoryFeb 16, 2016 - 2:59 a.m.

CVE-2015-7576

2016-02-1602:59:00

CWE-254

[email protected]

web.nvd.nist.gov

cve-2015-7576

ruby on rails

http_basic_authenticate_with

action controller

basic authentication

nvd

security vulnerability

timing attack

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

5.6 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.019 Low

EPSS

Percentile

88.3%

JSON

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.

CPENameOperatorVersion
rubyonrails:ruby_on_railsrubyonrails ruby on railseq4.0.13
rubyonrails:ruby_on_railsrubyonrails ruby on railseq4.0.12
rubyonrails:ruby_on_railsrubyonrails ruby on railseq4.0.10
rubyonrails:ruby_on_railsrubyonrails ruby on railseq4.0.11.1
rubyonrails:ruby_on_railsrubyonrails ruby on railseq4.0.11
rubyonrails:ruby_on_railsrubyonrails ruby on railseq4.1.11
rubyonrails:ruby_on_railsrubyonrails ruby on railsle3.2.22
rubyonrails:railsrubyonrails railseq4.0.0
rubyonrails:railsrubyonrails railseq4.0.1
rubyonrails:railsrubyonrails railseq4.0.2

CPE	Name	Operator	Version
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	eq	4.0.13
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	eq	4.0.12
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	eq	4.0.10
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	eq	4.0.11.1
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	eq	4.0.11
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	eq	4.1.11
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	le	3.2.22
rubyonrails:rails	rubyonrails rails	eq	4.0.0
rubyonrails:rails	rubyonrails rails	eq	4.0.1
rubyonrails:rails	rubyonrails rails	eq	4.0.2