Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2015-9238

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two str

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HackerOne secure-compare node module

  • <=3.0.0affected

References