CVE-2013-5679
low
CVSS v3
—
CVSS v2
2.6
VIR risk
2.6
Description
Missing Cryptographic Step in OWASP Enterprise Security API for Java
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdf
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.owasp.esapi:esapi | >=2.0.0,<2.1.0 | 2.1.0 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| owasp | enterprise_security_api | 2.0 | |
| owasp | enterprise_security_api | 2.0.1 | |
References
- http://code.google.com/p/owasp-esapi-java/issues/detail?id=306
- http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.html
- http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdf
- http://www.securityfocus.com/bid/62415
- https://nvd.nist.gov/vuln/detail/CVE-2013-5679
- https://github.com/ESAPI/esapi-java-legacy/commit/41138fef5f63d9cf0d5e05d2bee2c7f682ffef3f
- https://github.com/ESAPI/esapi-java-legacy
CWEs
CWE-310
Verify integrity in audit chain (admin only). AS-IS.