Homepage About Snyk

Information Exposure Affecting org.apache.rave:rave-web Open this link in a new tab package, versions [0.11,0.20)

0.0
medium

  • Exploit Maturity

    Mature

  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-ORGAPACHERAVE-30718

  • published

    18 May 2015

  • disclosed

    14 Mar 2013

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 14 Mar 2013

CVE-2013-1814 Open this link in a new tab
CWE-200 Open this link in a new tab

Overview

org.apache.rave:rave-web The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

References