CVE-2013-1814: Infoleak
First published: Thu Mar 14 2013(Updated: )
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =0.11 | ||
| =0.12 | ||
| =0.13 | ||
| =0.14 | ||
| =0.15 | ||
| =0.16 | ||
| =0.17 | ||
| =0.18 | ||
| =0.19 | ||
| =0.20 | ||
| Apache Rave | =0.11 | |
| Apache Rave | =0.12 | |
| Apache Rave | =0.13 | |
| Apache Rave | =0.14 | |
| Apache Rave | =0.15 | |
| Apache Rave | =0.16 | |
| Apache Rave | =0.17 | |
| Apache Rave | =0.18 | |
| Apache Rave | =0.19 | |
| Apache Rave | =0.20 | |
| maven/org.apache.rave:rave-portal-resources | >=0.11<0.20.1 | 0.20.1 |
| maven/org.apache.rave:rave-web | >=0.11<0.20.1 | 0.20.1 |
| maven/org.apache.rave:rave-core | >=0.11<0.20.1 | 0.20.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
- http://www.exploit-db.com/exploits/24744/
- https://nvd.nist.gov/vuln/detail/CVE-2013-1814
- https://github.com/apache/rave/commit/546edbaacfcb7b3fcc81aafe37a5c58e401b66c6
- https://web.archive.org/web/20130512040207/http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
- https://github.com/advisories/GHSA-428j-q447-47rw (Advisory)
Frequently Asked Questions
What is the severity of CVE-2013-1814?
CVE-2013-1814 is classified as a medium severity vulnerability that allows exposure of sensitive information.
How do I fix CVE-2013-1814?
To fix CVE-2013-1814, upgrade Apache Rave to version 0.20.1 or higher.
Who is affected by CVE-2013-1814?
CVE-2013-1814 affects authenticated users of Apache Rave versions 0.11 through 0.20.
What type of information can be exposed by CVE-2013-1814?
CVE-2013-1814 can expose sensitive information including user password hashes.
Is there a patch available for CVE-2013-1814?
Yes, a patch for CVE-2013-1814 is available in version 0.20.1 of Apache Rave.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-428j-q447-47rw
- alias/CVE-2013-1814
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/softwarecombine
- agent/severity
- agent/weakness
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory
- source/GitHub
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/apache
- canonical/apache rave
- version/apache rave/0.11
- version/apache rave/0.12
- version/apache rave/0.13
- version/apache rave/0.14
- version/apache rave/0.15
- version/apache rave/0.16
- version/apache rave/0.17
- version/apache rave/0.18
- version/apache rave/0.19
- version/apache rave/0.20
- package-manager/maven