CVE-2013-5679
First published: Mon Sep 30 2013(Updated: )
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OWASP Enterprise Security API | =2.0 | |
| OWASP Enterprise Security API | =2.0.1 | |
| maven/org.owasp.esapi:esapi | >=2.0.0<2.1.0 | 2.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://code.google.com/p/owasp-esapi-java/issues/detail?id=306
- http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.html
- http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdf
- http://www.securityfocus.com/bid/62415
- https://nvd.nist.gov/vuln/detail/CVE-2013-5679
- https://github.com/ESAPI/esapi-java-legacy/commit/41138fef5f63d9cf0d5e05d2bee2c7f682ffef3f
- https://github.com/advisories/GHSA-jcp9-796g-pv9p (Advisory)
Frequently Asked Questions
What is the severity of CVE-2013-5679?
CVE-2013-5679 has a Medium severity due to its potential to allow remote attackers to tamper with encrypted ciphertext.
How do I fix CVE-2013-5679?
To fix CVE-2013-5679, upgrade to OWASP Enterprise Security API version 2.1.0 or later.
What impact does CVE-2013-5679 have on my application?
CVE-2013-5679 may allow an attacker to bypass cryptographic protections, leading to unauthorized data access or manipulation.
Which versions of OWASP ESAPI are affected by CVE-2013-5679?
CVE-2013-5679 affects OWASP ESAPI versions 2.0 and 2.0.1.
Is CVE-2013-5679 a remote exploitation vulnerability?
Yes, CVE-2013-5679 can be exploited remotely by attackers to manipulate encrypted data.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-jcp9-796g-pv9p
- alias/CVE-2013-5679
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/remedy
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- agent/source
- vendor/owasp
- canonical/owasp enterprise security api
- version/owasp enterprise security api/2.0
- version/owasp enterprise security api/2.0.1
- package-manager/maven