CWE-1254: Incorrect Comparison Logic Granularity
The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.
A kind of CWE-208 Observable Timing Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, macos, ios and ipados +1 more +3 more A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18... 7.5 High
- ci4-cms-erp ci4ms CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) 8.8 High
- ci4-cms-erp ci4ms CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) 8.8 High
- openclaw OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation 4.8 Medium
- miyagawa plack::middleware::session, plack plack-middleware-session +1 more Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks 7.5 High
- gocd GoCD API authentication of user access tokens subject to timing attack during comparison 6.5 Medium
- doorkeeper project doorkeeper Doorkeeper is vulnerable to replay attacks 9.1 Critical
- uglifyjs project uglifyjs Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js 9.8 Critical