GitHub Advisoryadvisory · Maven

GHSA-2g56-7jv7-wxxq Missing Cryptographic Step in OWASP Enterprise Security API for Java

MEDIUM Published 2022-05-14 Modified 2024-03-05 Official page ↗
Aliases
CVE-2013-5960
Ecosystem
Maven
Packages
org.owasp.esapi:esapi
Severity
Moderate
Weaknesses
CWE-325
Reviewed
2022-07-08

Affected packages

• Maven org.owasp.esapi:esapi: >= 2.0.0.0, < 2.1.0.1 → fixed in 2.1.0.1

Description

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Related

Alias · CVE (1)

  • CVE-2013-5960 The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x… vulnerability

Weakness · CWE (1)

  • CWE-325 Missing Cryptographic Step weakness

References