What is the CVSS score of CVE-2013-5960?

CVE-2013-5960 has a CVSS 2.0 base score of 5.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2013-5960?

Yes, a public proof-of-concept exploit is available for CVE-2013-5960. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2013-5960?

Yes, a patch is available for CVE-2013-5960. Update the affected software to the latest version immediately.

Java CVE-2013-5960

MEDIUM

Cryptographic Issues (CWE-310)

2013-09-30 cve@mitre.org

Java Authentication Bypass Enterprise Security Api

5.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Sep 30, 2013 - 17:09 cve.org

MEDIUM 5.8

DescriptionCVE.org

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-310. The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679. Affected products include: Owasp Enterprise Security Api. Version information: before 2.1.0.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.