CVE-2013-1814

EPSS 83.0%

Apache Rave information disclosure vulnerability

發布日:2022/5/17修改日:2024/12/6

描述

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

受影響套件(3)

Maven/org.apache.rave:rave-core>= 0.11, < 0.20.1
Maven/org.apache.rave:rave-portal-resources>= 0.11, < 0.20.1
Maven/org.apache.rave:rave-web>= 0.11, < 0.20.1

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-1814
PATCHhttps://github.com/apache/rave
WEBhttp://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
WEBhttps://github.com/apache/rave/commit/546edbaacfcb7b3fcc81aafe37a5c58e401b66c6
WEBhttps://web.archive.org/web/20130512040207/http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
WEBhttp://www.exploit-db.com/exploits/24744