Apache Rave information disclosure vulnerability
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2013-1814US | medium4.0 | Exploit | ||
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.htmlWEB
- http://www.exploit-db.com/exploits/24744WEB
- https://github.com/apache/ravePACKAGE
- https://github.com/apache/rave/commit/546edbaacfcb7b3fcc81aafe37a5c58e401b66c6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2013-1814ADVISORY
- https://web.archive.org/web/20130512040207/http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan