Description

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Remediation

References

https://nodesecurity.io/advisories/50

https://github.com/vdemedes/secure-compare/pull/1

Related Vulnerabilities

CVE-2022-1295 Vulnerability in maven package org.webjars.bowergithub.alvarotrigo:fullpage.js

CVE-2021-32624 Vulnerability in npm package keystone

CVE-2019-16550 Vulnerability in maven package org.jenkins-ci.plugins.m2release:m2release

CVE-2017-16170 Vulnerability in npm package liuyaserver

CVE-2018-1000023 Vulnerability in npm package insight-api

Severity

Medium

Classification

CWE-134 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Third Party Advisory