Home

CVE-2015-7576

Description

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.

Risk Information

Base Score
3.7
MODERATE
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
Exploitation Probability
1.574

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2015-7576,CVE-2016-0751,CVE-2016-0752 are fixed in Ruby-actionpack 3.2.22.1Windows
Vulnerabilities CVE-2015-7576,CVE-2016-0751,CVE-2016-0752 are fixed in Ruby-actionpack 4.1.14.1Windows
rails security update(DSA-3509-1) rails_4.1.8-1+deb8u2_all.debLinux
Vulnerabilities CVE-2015-7576,CVE-2016-0751,CVE-2016-0752 are fixed in Ruby-actionpack for Linux 3.2.22.1Linux
Vulnerabilities CVE-2015-7576,CVE-2016-0751,CVE-2016-0752 are fixed in Ruby-actionpack for Linux 4.1.14.1Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234