CVE-2013-5960: Missing Cryptographic Step in OWASP Enterprise… (CVSS 5.8)

Description

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Exploit likelihood

1.65%Up 0.3 points since Feb 4, 2022

Affected products

owasp enterprise security api

Affected packages

Affected packages
Package	Affected	Fixed
`org.owasp.esapi:esapi` Maven	2.0.0.0 to 2.1.0.0	2.1.0.1
`org.owasp.esapi:esapi` Maven	2.0.0.0 up to 2.1.0.1, plus listed versions 2.0.12.0GA2.0_rc102.0_rc112.0_rc92.1.0	2.1.0.1

What each source reports

NVD Score used5.8

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Record: CVE-2013-5960
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE ListNo score

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Record: CVE-2013-5960
Updated: 2026-11-02

EUVDEUVD-2022-1979No score

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Record: EUVD-2022-1979
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2g56-7jv7-wxxqNo score

Missing Cryptographic Step in OWASP Enterprise Security API for Java

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Record: GHSA-2g56-7jv7-wxxq
Weakness: CWE-325
Updated: 2026-11-02

OSVGHSA-2g56-7jv7-wxxqNo score

Missing Cryptographic Step in OWASP Enterprise Security API for Java

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.

Record: GHSA-2g56-7jv7-wxxq
Weakness: CWE-325
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 5 moreShow less