{"id":"CVE-2013-4114","aliases":["DEBIAN-CVE-2013-4114","EUVD-2013-4043","GHSA-fxjx-3gvf-4c8w","MGASA-2013-0262","UBUNTU-CVE-2013-4114","openSUSE-SU-2024:10397-1"],"status":"published","title":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for...","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02447,"percentile":0.84455,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-255"],"published":"2013-08-16T17:00:00Z","modified":"2026-09-01T20:03:16Z","fixes":[{"ecosystem":"Debian:12","package":"nagstamon","fixed_in":["0.9.9-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nagstamon","fixed_in":["0.9.9-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nagstamon","fixed_in":["0.9.9-2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"nagstamon","fixed_in":["0.9.9-1.2.mga3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nagstamon","fixed_in":["2.0.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nagstamon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nagstamon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nagstamon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"nagstamon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-1.2.mga3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nagstamon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.1"}]}]}],"products":[{"vendor":"henri_wahl","product":"nagstamon"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/07/11/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/54072","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugs.gentoo.org/show_bug.cgi?id=476538","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=983673","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://nagstamon.ifw-dresden.de/docs/security/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00072.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/54276","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4114"},{"url":"http://nagstamon.ifw-dresden.de/docs/security"},{"url":"https://github.com/advisories/GHSA-fxjx-3gvf-4c8w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4114","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0262.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10779","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-July/111698.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-4114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4114","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4114","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4114","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2013-08-16T17:00:00Z","modified":"2024-09-16T17:44:11.443Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4043","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2013-08-16T17:00:00Z","modified":"2024-09-16T17:44:11Z","updated_at":"2026-11-03T00:55:39.247967Z"}],"ghsa":[{"id":"GHSA-fxjx-3gvf-4c8w","title":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for...","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2022-05-17T05:06:11Z","modified":"2025-04-11T04:13:54Z","updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-4114","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2013-08-16T17:55:05.13Z","modified":"2026-06-16T23:56:39.06Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-255"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-4114","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2013-08-16T17:55:05Z","modified":"2026-04-16T06:18:27.127555099Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4114","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2013-08-16T17:55:05.13Z","modified":"2026-09-01T20:03:16.432243762Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0262","title":"Updated nagstamon package fixes security vulnerability","description":"A user details information exposure flaw was found in the way Nagstamon\nperformed automated requests to get information about available updates.\nRemote attackers could use this flaw to obtain user credentials for servers\nmonitored by the desktop status monitor due to their improper (base64\nencoding-based) encoding in the HTTP request, when the HTTP Basic\nauthentication scheme was used (CVE-2013-4114).\n","status":"published","published":"2013-08-30T17:19:33Z","modified":"2026-04-16T06:25:40.139100292Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10397-1","title":"nagstamon-2.0.1-1.1 on GA media","description":"These are all security issues fixed in the nagstamon-2.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:44.176291Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2013-4114","description":"The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"withdrawn","published":"2013-08-16T17:55:00Z","modified":"2025-07-16T07:31:19.118574Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}