What is GHSA-428j-q447-47rw?

GHSA-428j-q447-47rw is a security advisory published by GitHub Security Advisories with Medium severity. Apache Rave information disclosure vulnerability

Which CVE IDs does GHSA-428j-q447-47rw cover?

GHSA-428j-q447-47rw covers the following CVE IDs: CVE-2013-1814. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-428j-q447-47rw?

GHSA-428j-q447-47rw affects 3 products, including: maven/org.apache.rave:rave-core:\u003e= 0.11, \u003c 0.20.1; maven/org.apache.rave:rave-web:\u003e= 0.11, \u003c 0.20.1; maven/org.apache.rave:rave-portal-resources:\u003e= 0.11, \u003c 0.20.1.

GHSA-428j-q447-47rwMedium

Apache Rave information disclosure vulnerability

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 5, 2024

🔗 CVE IDs covered (1)

CVE-2013-1814 →

📋 Description

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

🎯 Affected products3

maven/org.apache.rave:rave-core:>= 0.11, < 0.20.1
maven/org.apache.rave:rave-web:>= 0.11, < 0.20.1
maven/org.apache.rave:rave-portal-resources:>= 0.11, < 0.20.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2013-1814
http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
http://www.exploit-db.com/exploits/24744/
https://github.com/apache/rave/commit/546edbaacfcb7b3fcc81aafe37a5c58e401b66c6
https://web.archive.org/web/20130512040207/http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
https://github.com/advisories/GHSA-428j-q447-47rw