CVE

Id
67326  
CVE No.
CVE-2013-7379  
Status
Candidate  
Description
The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a string, which allows remote attackers to bypass authentication via a string in the access-key header that partially matches config.master.api.access_key.  
Phase
Assigned (20140514)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
649460 67326 CVE-2013-7379 MLIST:[oss-security] 20140513 CVE request: various NodeJS module vulnerabilities  View
649461 67326 CVE-2013-7379 URL:http://www.openwall.com/lists/oss-security/2014/05/13/1  View
649462 67326 CVE-2013-7379 MLIST:[oss-security] 20140514 Re: CVE request: various NodeJS module vulnerabilities  View
649463 67326 CVE-2013-7379 URL:http://www.openwall.com/lists/oss-security/2014/05/15/2  View
649464 67326 CVE-2013-7379 MISC:https://nodesecurity.io/advisories/Tomato_API_Admin_Auth_Weakness  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24902 JVNDB-2013-006477 UnrealIRCd におけるサービス運用妨害 (DoS) の脆弱性 UnrealIRCd には、SSL に関する処理に不備があるため、サービス運用妨害 (NULL ポインタデリファレンスおよびクラッシュ) 状態にされる脆弱性が存在します。 CVE-2013-7384 67326 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006477.html  View