CVE-2013-1814
apache rave: no CVSS score yet. EPSS 74% chance of exploitation in the next 30 days. Fixed in org.apache.rave:rave-core 0.20.1.
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
- EPSS
- 74% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:rave
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-428j-q447-47rw | Maven | org.apache.rave:rave-core | >=0.11 <0.20.1 | 0.20.1 |
| GHSA-428j-q447-47rw | Maven | org.apache.rave:rave-web | >=0.11 <0.20.1 | 0.20.1 |
| GHSA-428j-q447-47rw | Maven | org.apache.rave:rave-portal-resources | >=0.11 <0.20.1 | 0.20.1 |