CVE-2013-1814

Published: Mar 14, 2013Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Affected (10)

Products: Apache: Rave

Apache

1 product

Rave

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Apache Rave	Version 0.11
Apache Rave	Version 0.12
Apache Rave	Version 0.13
Apache Rave	Version 0.14
Apache Rave	Version 0.15
Apache Rave	Version 0.16
Apache Rave	Version 0.17
Apache Rave	Version 0.18
Apache Rave	Version 0.19
Apache Rave	Version 0.20

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html

Source: secalert@redhat.com

Exploit

http://www.exploit-db.com/exploits/24744/

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.exploit-db.com/exploits/24744/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.