VULNERABILITY INTELLIGENCE

CVE-2015-9238

CVSS score5.3 MEDIUM
EPSS probability1.48%
CISA KEVNot currently listed
Published2018-05-31
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Weakness classification

  • CWE-134: Use of Externally-Controlled Format String
  • CWE-697: Incorrect Comparison

Primary references