Information Disclosure

2022-02-1104:56:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

29.4%

JSON

hive-service is vulnerable to information disclosure. The vulnerability exists because the verifyAndExtract function of CookieSigner.java uses a constant-time comparison for cookie signature verification, allowing an attacker to recover another user’s cookie signature.

CPENameOperatorVersion
hive serviceeq1.2.2
hive servicele2.3.7
hive servicele2.1.0
hive servicele3.1.2
hive serviceeq1.2.2
hive servicele2.3.7
hive servicele2.1.0
hive servicele3.1.2

Name	Operator	Version
hive service	eq	1.2.2
hive service	le	2.3.7
hive service	le	2.1.0
hive service	le	3.1.2
hive service	eq	1.2.2
hive service	le	2.3.7
hive service	le	2.1.0
hive service	le	3.1.2