CVE-2013-5679: Low severity owasp enterprise security api vulnerability
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5679?
CVE-2013-5679 has a Medium severity due to its potential to allow remote attackers to tamper with encrypted ciphertext.
How do I fix CVE-2013-5679?
To fix CVE-2013-5679, upgrade to OWASP Enterprise Security API version 2.1.0 or later.
What impact does CVE-2013-5679 have on my application?
CVE-2013-5679 may allow an attacker to bypass cryptographic protections, leading to unauthorized data access or manipulation.
Which versions of OWASP ESAPI are affected by CVE-2013-5679?
CVE-2013-5679 affects OWASP ESAPI versions 2.0 and 2.0.1.
Is CVE-2013-5679 a remote exploitation vulnerability?
Yes, CVE-2013-5679 can be exploited remotely by attackers to manipulate encrypted data.