CVE-2013-5960

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://code.google.com/p/owasp-esapi-java/issues/detail?id=306Exploit
http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.htmlExploit
http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdfPatch, Vendor Advisory
http://www.securityfocus.com/bid/62415Third Party Advisory, VDB Entry
https://github.com/ESAPI/esapi-java-legacy/blob/master/documentation/esapi4java-core-2.1.0.1-release-notes.txtRelease Notes, Third Party Advisory
https://github.com/ESAPI/esapi-java-legacy/issues/359Issue Tracking, Third Party Advisory
https://github.com/esapi/esapi-java-legacy/issues/306Issue Tracking, Third Party Advisory
http://code.google.com/p/owasp-esapi-java/issues/detail?id=306Exploit
http://lists.owasp.org/pipermail/esapi-dev/2013-August/002285.htmlExploit
http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/ESAPI-security-bulletin1.pdfPatch, Vendor Advisory
http://www.securityfocus.com/bid/62415Third Party Advisory, VDB Entry
https://github.com/ESAPI/esapi-java-legacy/blob/master/documentation/esapi4java-core-2.1.0.1-release-notes.txtRelease Notes, Third Party Advisory
https://github.com/ESAPI/esapi-java-legacy/issues/359Issue Tracking, Third Party Advisory
https://github.com/esapi/esapi-java-legacy/issues/306Issue Tracking, Third Party Advisory

Timeline

Published: Sep 30, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-59616.8Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrar CVE-2013-59625.1Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPres CVE-2013-59636.8Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to CVE-2013-59642.1Cross-site scripting (XSS) vulnerability in the administration page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote authe CVE-2013-59655.0The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hook_query_alter function, which might al CVE-2013-59664.3Cross-site scripting (XSS) vulnerability in ZK Framework before 5.0.13 allows remote attackers to inject arbitrary web script or HTML via un CVE-2013-59677.5Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attack CVE-2013-59684.3Cross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents, allows remote attackers to inject CVE-2013-59707.1hostd-vmdb in VMware ESXi 4.0 through 5.0 and ESX 4.0 through 4.1 allows remote attackers to cause a denial of service (hostd-vmdb service o CVE-2013-59716.8Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hija CVE-2013-59727.2VMware Workstation 9.x before 9.0.3 and VMware Player 5.x before 5.0.3 on Linux do not properly handle shared libraries, which allows host O CVE-2013-59734.4VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power