Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-2G56-7JV7-WXXQ
HistoryMay 14, 2022 - 1:37 a.m.

Missing Cryptographic Step in OWASP Enterprise Security API for Java

2022-05-1401:37:06
CWE-325
GitHub Advisory Database
github.com
13

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

74.9%

JSON

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

CPENameOperatorVersion
org.owasp.esapi:esapile2.1.0.0

Related

prion 2
cve 2
fedora 2
nessus 2
openvas 3
osv 2
github 1
securityvulns 2
mageia 1
ibm 2
prion
prion
Default configuration
2013-09-30 17:09:00
Default configuration
2013-09-30 17:09:00
cve
cve
CVE-2013-5960
2013-09-30 17:09:00
CVE-2013-5679
2013-09-30 17:09:00
fedora
fedora
[SECURITY] Fedora 21 Update: owasp-esapi-java-2.1.0-1.fc21
2015-01-14 23:57:44
[SECURITY] Fedora 20 Update: owasp-esapi-java-2.1.0-2.fc20
2015-01-14 23:58:56
nessus
nessus
Fedora 20 : owasp-esapi-java-2.1.0-2.fc20 (2015-0259)
2015-01-15 00:00:00
Fedora 21 : owasp-esapi-java-2.1.0-1.fc21 (2015-0322)
2015-01-15 00:00:00
openvas
openvas
Fedora Update for owasp-esapi-java FEDORA-2015-0259
2015-01-15 00:00:00
Fedora Update for owasp-esapi-java FEDORA-2015-0322
2015-01-15 00:00:00
Mageia: Security Advisory (MGASA-2015-0064)
2022-01-28 00:00:00
osv
osv
Missing Cryptographic Step in OWASP Enterprise Security API for Java
2022-05-14 01:37:06
Missing Cryptographic Step in OWASP Enterprise Security API for Java
2022-05-17 03:56:06
github
github
Missing Cryptographic Step in OWASP Enterprise Security API for Java
2022-05-17 03:56:06
securityvulns
securityvulns
OWASP ESAPI Security Advisory: MAC Bypass in ESAPI Symmetric Encryption
2013-10-03 00:00:00
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2013-10-03 00:00:00
mageia
mageia
Updated owasp-esapi-java packages fix CVE-2013-5679
2015-02-11 23:47:51
ibm
ibm
Security Bulletin: B2B API of IBM Sterling B2B Integrator vulnerable to security bypass due to OWASP ESAPI (CVE-2013-5960)
2023-01-03 16:03:26
Security Bulletin: IBM Controller has addressed multiple vulnerabilities
2024-05-01 21:46:16

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

74.9%

JSON
Related for GHSA-2G56-7JV7-WXXQ
prion2cve2fedora2nessus2openvas3osv2github1securityvulns2mageia1ibm2