Vulnerability CVE-2013-5679
Published: 2013-09-30   Modified: 2016-05-06

Description:
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
OWASP ESAPI Symmetric Encryption MAC Bypass
Philippe Arteau
17.09.2013

Type:

CWE-310

 (Cryptographic Issues)

CVSS2 => (AV:L/AC:H/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.6/10
4.9/10
1.9/10
Exploit range
Attack complexity
Authentication
Local
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Owasp -> Enterprise security api 

 References:
http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdf
http://www.securityfocus.com/bid/62415
http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.html
http://code.google.com/p/owasp-esapi-java/issues/detail?id=306
Copyright 2025, cxsecurity.com

 

Back to Top