GitHub Advisoryadvisory · Maven

GHSA-428j-q447-47rw Apache Rave information disclosure vulnerability

MEDIUM Published 2022-05-17 Modified 2024-01-05 Official page ↗
Aliases
CVE-2013-1814
Ecosystem
Maven
Packages
org.apache.rave:rave-core, org.apache.rave:rave-web, org.apache.rave:rave-portal-resources
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-01-05

Affected packages

• Maven org.apache.rave:rave-core: >= 0.11, < 0.20.1 → fixed in 0.20.1 • Maven org.apache.rave:rave-web: >= 0.11, < 0.20.1 → fixed in 0.20.1 • Maven org.apache.rave:rave-portal-resources: >= 0.11, < 0.20.1 → fixed in 0.20.1

Description

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Related

Alias · CVE (1)

  • CVE-2013-1814 The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References