Description
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
Remediation
References
http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
http://www.exploit-db.com/exploits/24744/
Related Vulnerabilities
CVE-2019-10062 Vulnerability in npm package aurelia-framework
CVE-2021-21345 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2018-3758 Vulnerability in npm package express-cart
CVE-2020-28449 Vulnerability in npm package decal
CVE-2021-28163 Vulnerability in maven package org.eclipse.jetty:jetty-deploy