Vulnerability Intelligence Report
CVE-2021-41615
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:1.07%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| embedthis | goahead | 2.1.8 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.067%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2021-09-25T00:00:00 |
| Published | 2022-08-08T18:26:11 |
| Last Updated | 2024-08-04T03:15:29 |
Community Chatter & Buzz