CVE:CVE-2013-1814
CNNVD:CNNVD-201303-276
Apache Rave是一个全新的Web和社交混搭引擎。
Apache Rave 0.11至0.20版本中的User RPC API中users/get程序中存在漏洞。通过偏移参数，远程认证攻击者利用该漏洞获得所有用户账户的敏感信息，如在响应的密码字段中发现密码哈希值。
solution:Upgrade apache rave to a higher version than 0.11,0.12,0.13,0.14,0.15,0.16,0.17,0.18,0.19,0.20,and avoid the version 0.11,0.12,0.13,0.14,0.15,0.16,0.17,0.18,0.19,0.20