CVE-2013-1814: Apache Rave User RPC API information disclosure via offset parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityPassword hash disclosure to any authenticated user with public exploit code and very high EPSS probability makes this a serious credential-compromise risk despite the medium CVSS score.

What it is

The users/get program in Apache Rave's User RPC API fails to restrict the offset parameter, letting any authenticated user enumerate all user accounts. Responses expose sensitive fields including password hashes, so a low-privileged account can harvest credentials for the whole instance.

Impact

An attacker with a valid account gains read access to every user record and their password hashes, enabling offline cracking and follow-on account takeover. No write or denial-of-service capability is described.

Attack surface

Reachable over the network through the User RPC API endpoint; the CVSS vector AV:N/AC:L/Au:S indicates authentication is required but no user interaction. Any authenticated user, regardless of role, can issue the request.

Exploitation

Public exploit code exists (Exploit-DB 24744 and a Bugtraq post tagged Exploit), and EPSS is 0.738 with a 99.45 percentile, though the CVE is not in CISA KEV. No ransomware usage is documented.

What to do

• Upgrade Apache Rave past the affected 0.11 through 0.20 range to a fixed release.
• If upgrade is not possible, restrict or disable the users/get RPC method and block the offset parameter.
• Enforce least privilege on RPC API access and audit which accounts can call user-listing methods.
• Rotate and re-hash stored credentials if exposure is suspected, since password hashes may have been retrieved.

Detection

• Monitor RPC API requests to users/get for unusual or iterated offset values from a single account.
• Alert on any response payload containing password or hash fields from user-listing endpoints.
• Baseline normal RPC call volume per account and flag bulk user enumeration patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.