CVE-2024-47178

MEDIUM

basic-auth-connect <1.1.0 - Info Disclosure

Title source: llm

Description

basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_confirm

https://github.com/expressjs/basic-auth-connect/security/advisories/GHSA-7p89-p6hx-q4fw

Patch x_refsource_misc

https://github.com/expressjs/basic-auth-connect/commit/bac1e6a8530e1efd0028800b9b588a37adb0d203

View Patch ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0050

EPSS Percentile 38.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-208

Status published

Products (2)

expressjs/basic-auth-connect < 1.1.0

npm/basic-auth-connect 0 - 1.1.0npm

Published Sep 30, 2024

Tracked Since Feb 18, 2026