CVE-2013-2566

At a glance

Severity: MEDIUM 5.9
EPSS: EPSS 84.42 % · percentile 100 (2026-10-27)
State: PUBLISHED
Published: 2013-03-14
Updated: 2026-05-22
Assigner: mitre
NVD status: Modified

Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP
CVSS 3.1	MEDIUM 5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 3.0	MEDIUM 5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

European references

ENISA EUVD · EUVD-2013-2508
GCVE · GCVE-0-2013-2566

CERT-FR advisories

CERTFR-2024-AVI-0002 — Multiples vulnérabilités dans Moxa OnCell G3150A-LTE Series · cert.ssi.gouv.fr
CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
CERTFR-2016-AVI-244 — Multiples vulnérabilités dans Oracle Sun Systems Products Suite · cert.ssi.gouv.fr
CERTFR-2016-AVI-136 — Multiples vulnérabilités dans Oracle Sun Systems Products Suite · cert.ssi.gouv.fr
CERTFR-2015-AVI-431 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTA-2013-AVI-642 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:* ≥ 3.0.0 ≤ 3.9.1
cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:*
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* ≥ 3.0.0 ≤ 3.2.11
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* ≥ 4.0.0 ≤ 4.0.4
cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp_1121
cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp_1121
cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp_1121
cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp_1121
cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp_1121
cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp2280
cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp2280
cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* ≥ xcp < xcp2280
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* < 17.0.11
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* < 25.0.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* ≥ 24.1.0 < 24.1.1
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* < 2.22.1
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* < 24.1.1
cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* < 17.0.11

Affected products

Product	Versions
	affected n/a

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD