medium4.0Public exploit code
CVE-2013-1814
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user acc…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Rave 0.11 < 0.20 - User Information Disclosure2013-03-13 · webapps · multiple
Impact
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Rave | Versions 0.11, 0.12, 0.13, 0.14, 0.15, 0.16 |