peter bassill · operator
$ cve CVE-2019-10071 JSON

CVE-2019-10071

9.8
CRITICAL · CVSS 3.1 · EPSS 8.8% (pctl 95)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS8.75% — more likely to be exploited than 95% of all CVEs
WeaknessCWE-203
On CISA KEVno
Public exploitnone known
Published2019-09-16
Last modified2026-06-17

Affected (1)

VendorProduct
apachetapestry

References

→ the Explorer  ·  watch your stack  ·  NVD