apache/rave · Security
Apache Rave information disclosure vulnerability
- GHSA ID
- GHSA-428j-q447-47rw
- CVE ID
- CVE-2013-1814
- Severity
- medium
- Published
- Updated
Description
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-1814 ↗
- http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html ↗
- http://www.exploit-db.com/exploits/24744/ ↗
- https://github.com/apache/rave/commit/546edbaacfcb7b3fcc81aafe37a5c58e401b66c6 ↗
- https://web.archive.org/web/20130512040207/http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html ↗
- https://github.com/advisories/GHSA-428j-q447-47rw ↗