CVE-2021-41615

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-416169.8Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY,CVE-2021-416177.0sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplementCVE-2021-416197.2An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuraCVE-2021-41624.3archivy is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-416345.3A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames.CVE-2021-416358.8When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations oCVE-2021-416366.5MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire CVE-2021-416377.1Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which incluCVE-2021-416387.5The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files onCVE-2021-416395.5MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file.CVE-2021-41648.8calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-416418.4Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method c
CVE-2021-41615: Critical severity, CVSS 9.8 | Vulnix