Every CVE Search/ Get API key

CVE-2013-7239

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid...

4.8 MediumFix available

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Exploit likelihood

1.18%Down 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.8

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Record
CVE-2013-7239
CVSS 2.0
4.8 MediumAV:A/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Record
CVE-2013-7239
Updated
2026-11-02
EUVDEUVD-2013-7018 No score

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Record
EUVD-2013-7018
Updated
2026-11-03
GitHub AdvisoriesGHSA-v5qw-pp2p-cvpr No score

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid...

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Record
GHSA-v5qw-pp2p-cvpr
Weakness
CWE-287
Updated
2026-11-02
OSV No score

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Record
CVE-2013-7239
Updated
2026-11-02
OSVDEBIAN-CVE-2013-7239 No score

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Record
DEBIAN-CVE-2013-7239
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0018 No score

Updated memcached package fixes multiple security vulnerabilities

Updated memcached packages fix security vulnerability:

It was reported that SASL authentication could be bypassed due to a flaw related to the managment of the SASL authentication state. With a specially crafted request, a remote attacker may be able to authenticate with invalid SASL credentials (CVE-2013-7239).

Multiple issues in memcached before 1.4.17 which allow remote attackers to cause a denial of service by sending a request that causes a crash when memcached is running in verbose mode (CVE-2013-0179, CVE-2013-7290, CVE-2013-7291).

Record
MGASA-2014-0018
Updated
2026-11-02
OSVopenSUSE-SU-2024:10021-1 No score

memcached-1.4.33-1.1 on GA media

These are all security issues fixed in the memcached-1.4.33-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10021-1
Updated
2026-11-02
OSVSUSE-SU-2018:0778-1 No score

Security update for memcached

This update for memcached fixes the following issues:

Security issues fixed:

  • CVE-2011-4971: remote DoS (bsc#817781).
  • CVE-2013-0179: DoS when printing out keys to be deleted in verbose mode (bsc#798458).
  • CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).
  • CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).
  • CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).
  • CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).
  • CVE-2016-8705: Server update remote code execution (bsc#1007870).
  • CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).
  • CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).
Record
SUSE-SU-2018:0778-1
Updated
2026-11-02
OSVSUSE-SU-2018:0807-1 No score

Security update for memcached

This update for memcached fixes the following issues:

Security issues fixed:

  • CVE-2011-4971: remote DoS (bsc#817781).
  • CVE-2013-0179: DoS when printing out keys to be deleted in verbose mode (bsc#798458).
  • CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).
  • CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).
  • CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).
  • CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).
  • CVE-2016-8705: Server update remote code execution (bsc#1007870).
  • CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).
  • CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).
Record
SUSE-SU-2018:0807-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
memcached
Debian:12
 before 1.4.13-0.3
1.4.13-0.3
memcached
Debian:13
 before 1.4.13-0.3
1.4.13-0.3
memcached
Debian:14
 before 1.4.13-0.3
1.4.13-0.3
memcached
Debian:6.0
 before 1.4.5-1+deb6u1, plus listed versions
1.4.5-1
1.4.5-1+deb6u1
memcached
Debian:7
 before 1.4.13-0.2+deb7u1, plus listed versions
1.4.13-0.2
1.4.13-0.2+deb7u1
memcached
Mageia:3
 before 1.4.17-1.mga3
1.4.17-1.mga3
memcached
SUSE:OpenStack Cloud 7
 before 1.4.39-3.3.2
1.4.39-3.3.2
memcached
SUSE:Enterprise Storage 4
 before 1.4.39-3.3.2
1.4.39-3.3.2
memcached
SUSE:OpenStack Cloud 6
 before 1.4.39-3.3.1
1.4.39-3.3.1
memcached
openSUSE:Tumbleweed
 before 1.4.33-1.1
1.4.33-1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-7239 is a medium vulnerability (CVSS 4.8) in Memcached, published January 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in memcached 1.4.13-0.3.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open