CVE-2013-5679
published 2013-09-30CVE-2013-5679: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not…
PriorityP418low2.6CVSS 2.0
AVLACHAuNCPIPAN
EPSS
2.43%
82.5th percentile
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| owasp | enterprise_security_api | — | — |
| owasp | enterprise_security_api | — | — |
| owasp | enterprise_security_api | >= 2.0 < 2.1.0.1 | 2.1.0.1 |
CVSS provenance
nvdv2.02.6LOWAV:L/AC:H/Au:N/C:P/I:P/A:N
ghsa2.6LOW
osv2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing Cryptographic Step in OWASP Enterprise Security API for Java
ghsa·2022-05-17
CVE-2013-5679 [LOW] CWE-325 Missing Cryptographic Step in OWASP Enterprise Security API for Java
Missing Cryptographic Step in OWASP Enterprise Security API for Java
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
OSV
Missing Cryptographic Step in OWASP Enterprise Security API for Java
osv·2022-05-17
CVE-2013-5679 [LOW] Missing Cryptographic Step in OWASP Enterprise Security API for Java
Missing Cryptographic Step in OWASP Enterprise Security API for Java
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
OSV
Missing Cryptographic Step in OWASP Enterprise Security API for Java
osv·2022-05-14·CVSS 2.6
CVE-2013-5960 [LOW] Missing Cryptographic Step in OWASP Enterprise Security API for Java
Missing Cryptographic Step in OWASP Enterprise Security API for Java
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
GHSA
Missing Cryptographic Step in OWASP Enterprise Security API for Java
ghsa·2022-05-14·CVSS 2.6
CVE-2013-5960 [LOW] CWE-325 Missing Cryptographic Step in OWASP Enterprise Security API for Java
Missing Cryptographic Step in OWASP Enterprise Security API for Java
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-5679 CVE-2013-5960 owasp-esapi-java: symmetric encryption MAC bypass
bugzilla·2013-09-30·CVSS 2.6
CVE-2013-5679 [LOW] CVE-2013-5679 CVE-2013-5960 owasp-esapi-java: symmetric encryption MAC bypass
CVE-2013-5679 CVE-2013-5960 owasp-esapi-java: symmetric encryption MAC bypass
Owasp-Esapi-Java, a free, open source, web application security control library, was found to have a vulnerability, where it was possible to bypass the authenticity check by setting the MAC length to 0 and the MAC to null, when ESAPI symmetric crypto with CBC mode is used with PKCS#7 padding (called PKCS5Padding in Java), and an HMAC for authenticity.
The configuration could result in an exploitable vulnerability depending on the context for encryption and what degree an attacker can tamper with the serialized ciphertext, though only some ESAPI were found to be exploitable when using the default configuration. To be exploitable, an attacker would require the ability to modify ciphertext either at rest or in tra
Bugzilla
CVE-2013-5679 owasp-esapi-java: symmetric encryption MAC bypass [fedora-all]
bugzilla·2013-09-30·CVSS 2.6
CVE-2013-5679 [LOW] CVE-2013-5679 owasp-esapi-java: symmetric encryption MAC bypass [fedora-all]
CVE-2013-5679 owasp-esapi-java: symmetric encryption MAC bypass [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affe
http://code.google.com/p/owasp-esapi-java/issues/detail?id=306http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.htmlhttp://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdfhttp://www.securityfocus.com/bid/62415http://code.google.com/p/owasp-esapi-java/issues/detail?id=306http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.htmlhttp://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdfhttp://www.securityfocus.com/bid/62415
2013-09-30
Published