Apache Rave User Exposure

`CVE-2013-1814: Apache Rave exposes User over API  
  
Severity: Important  
  
Vendor: The Apache Software Foundation  
  
Versions Affected:  
Rave 0.11 to 0.20  
  
Description:  
Rave returns the full user object, including the salted and hashed  
password, via the User RPC API. This endpoint is only available to  
authenticated users, but will return all User objects in the database  
given the correct query.  
  
Mitigation:  
All users who rely on Rave's user management capabilities should  
upgrade to 0.20.1 or later.  
If an upgrade is infeasible, restrict access to the /app/api/user URL  
paths via Spring Security configuration or other means.  
  
Example:  
A request to:  
  
/app/api/rpc/users/get?offset=3DOFFSET  
  
will return the following:  
  
{"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result=  
Set":[{"entityId":1,"username":"canonical","email":"[email protected]",=  
"displayName":"Canonical  
User","additionalName":"canonical","familyName":"User","givenName":"Canonic=  
al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo=  
utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"=  
:[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/=  
collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n=  
ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=  
1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,=  
"openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP=  
ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ=  
ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod=  
e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d=  
efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE=  
xpired":true,"accountNonExpired":true},  
........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu=  
rrentPage":1}}  
  
Credit:  
This issue was discovered by Andreas Guth of RWTH Aachen University.  
  
References:  
http://tomcat.apache.org/security.html  
  
  
`