CVE-2015-9238

CVE-2015-9238

Vendor Hackerone
Product secure-compare node module
Weakness CWE-697
Published May 31, 2018
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Key dates

02Disclosure timeline

May 31, 2018 CVE published
September 16, 2024 Record updated