Basic HTTP Authentication Password Matching Vulnerability in GoAhead Web Server

CVE-2021-43298

What is CVE-2021-43298?

The GoAhead Web Server contains a vulnerability in its Basic HTTP authentication mechanism. The lack of a constant-time comparison function for password matching and the absence of any rate-limiting allows attackers to execute brute-force password attacks. By measuring the response time of the web server, an unauthenticated attacker can iterate through potential passwords and compromise access credentials, leading to unauthorized access.

References