CVE-2015-7576

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.

Published: 2016-02-15 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2015-7576 is rated Moderate Risk (50.3/100): CVSS Low severity, with high exploitation likelihood (EPSS 4.86%, 91th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +3.74% over the last day, indicating growing attacker interest. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2015-7576

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 1.12% 4.86% +3.74%
2 2026-05-23 1.57% 1.12% -0.46%
3 2026-03-04 — 1.57% —

Full EPSS history (42 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2015-7576

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
3.7 3.0 LOW
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.
 2.2 1.4 [email protected]
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
 8.6 2.9 [email protected]

Weakness enumeration for CVE-2015-7576

GitHub Security Advisory for CVE-2015-7576

GHSA-p692-7mm3-3fxg · Severity: low · Ecosystem: rubygems — actionpack is vulnerable to remote bypass authentication

OS Trackers for CVE-2015-7576

vendor priority summary link
debian not yet assigned CVE-2015-7576 not yet assigned priority: Debian including 1 source packages (rails), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2015-7576
redhat low — https://access.redhat.com/security/cve/CVE-2015-7576
suse medium CVE-2015-7576 severity moderate: SUSE including 19 source package names (libcontainment-insomnia-0.1.1-0.9.4.19, libjansson4-2.2.1-0.9.11.6, …), 38 product×package rows across 10 product lines (SUSE Enterprise Storage 2.1, SUSE Lifecycle Management Server 1.3, … (10 product lines)): Fixed 38. https://www.suse.com/security/cve/CVE-2015-7576/
ubuntu medium CVE-2015-7576 medium priority: Ubuntu including 10 source packages (rails, rails-4.0, …), 120 status rows across 12 suites (artful, bionic, cosmic, disco, precise, trusty, upstream, vivid, wily, xenial, yakkety, zesty): DNE 96, not-affected 14, ignored 8, released 2. https://ubuntu.com/security/CVE-2015-7576

Affected software / configurations for CVE-2015-7576

Vendor Product Version Raw CPE
rubyonrails rails 4.0.0 cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*
rubyonrails rails 4.0.0 cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*
rubyonrails rails 4.0.0 cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*
rubyonrails rails 4.0.0 cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*
rubyonrails rails 4.0.1 cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*
rubyonrails rails 4.0.1 cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*
rubyonrails rails 4.0.1 cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*
rubyonrails rails 4.0.1 cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*
rubyonrails rails 4.0.1 cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*
rubyonrails rails 4.0.2 cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*
rubyonrails rails 4.0.3 cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*
rubyonrails rails 4.0.4 cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*
rubyonrails rails 4.0.4 cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*
rubyonrails rails 4.0.5 cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*
rubyonrails rails 4.0.6 cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*
rubyonrails rails 4.0.6 cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*
rubyonrails rails 4.0.6 cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*
rubyonrails rails 4.0.6 cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*
rubyonrails rails 4.0.7 cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*
rubyonrails rails 4.0.8 cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*
rubyonrails rails 4.0.9 cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*
rubyonrails rails 4.0.10 cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*
rubyonrails rails 4.0.10 cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.0 cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*
rubyonrails rails 4.1.0 cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*
rubyonrails rails 4.1.0 cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*
rubyonrails rails 4.1.0 cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.0 cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*
rubyonrails rails 4.1.1 cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*
rubyonrails rails 4.1.2 cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*
rubyonrails rails 4.1.2 cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.2 cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*
rubyonrails rails 4.1.2 cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*
rubyonrails rails 4.1.3 cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*
rubyonrails rails 4.1.4 cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*
rubyonrails rails 4.1.5 cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*
rubyonrails rails 4.1.6 cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*
rubyonrails rails 4.1.6 cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.6 cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*
rubyonrails rails 4.1.7 cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*
rubyonrails rails 4.1.7.1 cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*
rubyonrails rails 4.1.8 cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*
rubyonrails rails 4.1.9 cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*
rubyonrails rails 4.1.9 cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.10 cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*
rubyonrails rails 4.1.10 cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.10 cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*
rubyonrails rails 4.1.10 cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*
rubyonrails rails 4.1.10 cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*
rubyonrails rails 4.1.12 cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*
rubyonrails rails 4.1.12 cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.13 cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*
rubyonrails rails 4.1.13 cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.14 cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*
rubyonrails rails 4.1.14 cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*
rubyonrails rails 4.1.14 cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*
rubyonrails rails 4.2.0 cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*
rubyonrails rails 4.2.1 cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*
rubyonrails rails 4.2.1 cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*
rubyonrails rails 4.2.1 cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*
rubyonrails rails 4.2.1 cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*
rubyonrails rails 4.2.1 cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*
rubyonrails rails 4.2.2 cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*
rubyonrails rails 4.2.3 cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*
rubyonrails rails 4.2.3 cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*
rubyonrails rails 4.2.4 cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*
rubyonrails rails 4.2.4 cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*
rubyonrails rails 4.2.5 cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*
rubyonrails rails 4.2.5 cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*
rubyonrails rails 4.2.5 cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*
rubyonrails rails 5.0.0 cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*
rubyonrails ruby_on_rails <= 3.2.22 cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*
rubyonrails ruby_on_rails 4.0.10 cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*

References for CVE-2015-7576

URL Tags
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
http://rhn.redhat.com/errata/RHSA-2016-0296.html
http://www.debian.org/security/2016/dsa-3464
http://www.openwall.com/lists/oss-security/2016/01/25/8
http://www.securityfocus.com/bid/81803
http://www.securitytracker.com/id/1034816
https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ
cvelogic Threat Intelligence