Every CVE Search/ Get API key

CVE-2013-1814

Apache Rave information disclosure vulnerability

4.0 MediumPublic exploitFix available

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Exploit likelihood

73.6%Down 8.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Record
CVE-2013-1814
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Record
CVE-2013-1814
Updated
2026-11-02
EUVDEUVD-2022-2267 No score

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Record
EUVD-2022-2267
Updated
2026-11-03
GitHub AdvisoriesGHSA-428j-q447-47rw No score

Apache Rave information disclosure vulnerability

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Record
GHSA-428j-q447-47rw
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-428j-q447-47rw No score

Apache Rave information disclosure vulnerability

The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.

Record
GHSA-428j-q447-47rw
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.rave:rave-core
Maven
 0.11 up to 0.20.1
0.20.1
org.apache.rave:rave-web
Maven
 0.11 up to 0.20.1
0.20.1
org.apache.rave:rave-portal-resources
Maven
 0.11 up to 0.20.1
0.20.1
org.apache.rave:rave-core
Maven
 0.11 up to 0.20.1, plus listed versions
0.120.140.150.160.180.190.20
0.20.1
org.apache.rave:rave-web
Maven
 0.11 up to 0.20.1, plus listed versions
0.120.140.150.160.180.190.20
0.20.1
org.apache.rave:rave-portal-resources
Maven
 0.11 up to 0.20.1, plus listed versions
0.120.140.150.160.180.190.20
0.20.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache Rave 0.11 < 0.20 - User Information Disclosure2013-03-13
MetasploitApache Rave User Information Disclosure
PoC in GitHubdannyEndorTest/java-vulnerable2026-05-21

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1814 is a medium vulnerability (CVSS 4.0) in Apache Rave, published March 14, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 73.6%, the 99th percentile. Fixed in org.apache.rave:rave-core 0.20.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open