CVE-2015-9238CWE-697

secure-compare 3.0.0 and below do not actually compare two strings properly

published May 31, 2018

CVSS
—
EPSS
1%
Percentile
73.5
In the wild
Unconfirmed
What it is

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01477 · 73.5th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2018-05-31T20:00Z
EPSS history
Timeline
  • 31 MAY 20:00Z
    secure-compare 3.0.0 and below do not actually compare two strings properly
    cvelistv5