CVE-2013-5960 — Missing Cryptographic Step in Enterprise Security API

CWE-325 — Missing Cryptographic Step5 documents5 sources
Severity
5.8MEDIUMNVD
CNA2.6GHSA2.6OSV2.6
EPSS
0.2%
top 61.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Owasp Enterprise Security API
Timeline
PublishedSep 30
Latest updateMay 14

Description

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages1 packages

▶NVDowasp/enterprise_security_api2.0 — 2.1.0.1

Patches

Patch: owasp-esapi-java.googlecode.com ↗Patch: owasp-esapi-java.googlecode.com ↗

🔴Vulnerability Details

3
OSV
Missing Cryptographic Step in OWASP Enterprise Security API for Java↗2022-05-14
▶
GHSA
Missing Cryptographic Step in OWASP Enterprise Security API for Java↗2022-05-14
▶
CVEList
CVE-2013-5960: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2↗2013-09-30
▶

💬Community

1
Bugzilla
CVE-2013-5679 CVE-2013-5960 owasp-esapi-java: symmetric encryption MAC bypass↗2013-09-30
▶
CVE-2013-5960 — Missing Cryptographic Step | cvebase