Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
OWASP ESAPI 加密问题漏洞
Vulnerability Description
OWASP Enterprise Security API（ESAPI，企业安全应用程序接口）是美国OWASP组织的一个免费、开源的网页应用程序安全控件库，它有助于编程人员开发低风险应用程序。 Java平台下的OWASP ESAPI 2.0.1版本中的对称加密实现中的认证加密功能中存在漏洞，该漏洞源于程序没有正确抵制对序列化密文的篡改。远程攻击者可通过攻击非默认配置中的既定密码模式，利用该漏洞绕过既定的加密保护机制。
CVSS Information
N/A
Vulnerability Type
N/A