CVE-2013-5679 — Missing Cryptographic Step in Enterprise Security API

CWE-310CWE-325 — Missing Cryptographic Step7 documents5 sources
Severity
2.6LOWNVD
EPSS
0.1%
top 83.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Owasp Enterprise Security API
Timeline
PublishedSep 30
Latest updateMay 17

Description

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.

CVSS vector

AV:L/AC:H/C:P/I:P/A:NExploitability: 1.9 | Impact: 4.9

Affected Packages1 packages

Patches

Patch: owasp-esapi-java.googlecode.com ↗Patch: owasp-esapi-java.googlecode.com ↗

🔴Vulnerability Details

4
GHSA
Missing Cryptographic Step in OWASP Enterprise Security API for Java↗2022-05-17
▶
OSV
Missing Cryptographic Step in OWASP Enterprise Security API for Java↗2022-05-17
▶
GHSA
Missing Cryptographic Step in OWASP Enterprise Security API for Java↗2022-05-14
▶
CVEList
CVE-2013-5679: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2↗2013-09-30
▶

💬Community

2
Bugzilla
CVE-2013-5679 CVE-2013-5960 owasp-esapi-java: symmetric encryption MAC bypass↗2013-09-30
▶
Bugzilla
CVE-2013-5679 owasp-esapi-java: symmetric encryption MAC bypass [fedora-all]↗2013-09-30
▶
CVE-2013-5679 — Missing Cryptographic Step | cvebase