-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure password comparison in UserService. The commit diff shows the vulnerable code was directly comparing plaintext passwords with 'ak.Password != args.Password'. String comparisons in Go are not constant-time - they exit early on first mismatch, creating observable timing differences. This allows attackers to perform statistical analysis to guess password characters. The patched version replaced this with hashed comparisons, confirming the original function's vulnerability. The file path and function name are explicitly shown in the diff and vulnerability description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cubefs/cubefs | go | < 3.3.1 | 3.3.1 |
Ongoing coverage of React2Shell