Description
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
Remediation
References
http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
http://www.exploit-db.com/exploits/24744/
Related Vulnerabilities
CVE-2022-1295 Vulnerability in npm package fullpage.js
CVE-2023-2479 Vulnerability in npm package appium-desktop
CVE-2020-11023 Vulnerability in maven package org.webjars.npm:jquery
CVE-2019-10323 Vulnerability in maven package org.jenkins-ci.plugins:artifactory
CVE-2019-18213 Vulnerability in maven package org.lsp4xml:org.eclipse.lsp4xml.extensions.emmet