CVE-2013-5960: Medium severity owasp enterprise security api vulnerability
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5960?
CVE-2013-5960 is considered a high severity vulnerability due to its potential to allow remote attackers to bypass cryptographic protections.
How do I fix CVE-2013-5960?
To mitigate CVE-2013-5960, upgrade to OWASP ESAPI version 2.1.0.1 or later.
What version of OWASP ESAPI is affected by CVE-2013-5960?
CVE-2013-5960 affects OWASP ESAPI for Java versions prior to 2.1.0.1.
What type of attacks can CVE-2013-5960 facilitate?
CVE-2013-5960 can facilitate attacks that involve tampering with serialized ciphertext, potentially allowing unauthorized access to sensitive data.
Is CVE-2013-5960 a client-side or server-side vulnerability?
CVE-2013-5960 is primarily a server-side vulnerability affecting applications using the OWASP ESAPI for Java.