CVE-2013-5679: Missing Cryptographic Step in OWASP Enterprise Security API for Java
Summary
CVE-2013-5679: Missing Cryptographic Step in OWASP Enterprise Security API for Java. Affects org.owasp.esapi:esapi versions >= 2.0.0, < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OWASP Enterprise Security API (ESAPI) for Java is a library that provides a set of security functions for Java applications. It aims to simplify the implementation of security controls and protect against common security vulnerabilities. The ESAPI library includes features for symmetric encryption, including authenticated encryption. Authenticated encryption ensures the integrity and authenticity of encrypted data by including a message authentication code (MAC) with the ciphertext. However, prior to version 2.1.0, the symmetric encryption implementation in ESAPI did not properly resist tampering with serialized ciphertext, making it vulnerable to attacks against authenticity in the default configuration.
Vulnerability Detail
The vulnerability (CVE-2013-5679) in the OWASP ESAPI for Java allows remote attackers to bypass cryptographic protection mechanisms by tampering with serialized ciphertext. This can be achieved by exploiting the null MAC and zero MAC length in the default configuration. By manipulating the ciphertext, an attacker can modify the encrypted data without detection, potentially leading to unauthorized access or data manipulation. The vulnerability has a low severity rating.
How To Fix
Latest published version: 2.7.0.1-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the OWASP ESAPI library is not feasible, a possible workaround is to implement additional checks and validation on the serialized ciphertext to detect tampering. This can involve verifying the integrity of the ciphertext using a separate mechanism, such as digital signatures or checksums. However, this workaround may introduce additional complexity and is not as robust as upgrading to the fixed version of the library.
Conclusion
The vulnerability in the OWASP Enterprise Security API for Java (CVE-2013-5679) allows remote attackers to bypass cryptographic protection mechanisms by tampering with serialized ciphertext. To mitigate this vulnerability, it is recommended to upgrade to version 2.1.0 or later of the OWASP ESAPI for Java library. Alternatively, additional checks and validation can be implemented on the serialized ciphertext as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.owasp.esapi:esapi →
FAQ
The OWASP ESAPI for Java library is a security library that provides functions and utilities to help developers implement security controls in Java applications. It aims to protect against common security vulnerabilities and simplify the implementation of secure coding practices.
Authenticated encryption is a cryptographic technique that combines encryption and message authentication to ensure the integrity and authenticity of encrypted data. It includes a message authentication code (MAC) with the ciphertext, allowing the recipient to verify the integrity of the data and detect any tampering.
The vulnerability allows remote attackers to bypass cryptographic protection mechanisms by tampering with serialized ciphertext. This can lead to unauthorized access or data manipulation if the encrypted data is not properly validated and authenticated.
The vulnerability has a low severity rating. While it can potentially lead to unauthorized access or data manipulation, it requires specific conditions to be met and can be mitigated by upgrading to the fixed version of the OWASP ESAPI for Java library.
There are no known public exploits specifically targeting this vulnerability in the OWASP ESAPI for Java library. However, it is always recommended to apply security patches and updates as soon as they become available to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for org.owasp.esapi:esapi.
