CVE-2013-0253 Security feature bypass in n/a
Apache Maven's default configuration disables SSL certificate checks, allowing attackers to perform man-in-the-middle attacks and spoof servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0253?
CVE-2013-0253 is a medium-severity vulnerability in n/a, published on 9 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
Weakness: CWE-16
Which versions are affected by CVE-2013-0253?
It affects 1 product.
Linux distribution packages (1)
jenkins Red Hat:openshift:1::el6 | All versions | 0:1.506-1.el6op |
Products include Apache Maven.
How do I fix CVE-2013-0253?
Change a configuration setting.
Is CVE-2013-0253 being exploited?
There is no known exploitation of CVE-2013-0253 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-33jw-8g2v-hrp6, RHSA-2013:0700.