What’s Vulnerable › Vulnerabilities

CVE-2010-3300

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-22 · updated 2026-06-16
• Weakness: CWE-649

Description

It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.

Affected products

• OWASP Enterprise Security Api For Java: before 2.0; 2.0, 2.0-rc1 — fixed in 2.0

How to fix

Upgrade to a fixed version: OWASP Enterprise Security Api For Java 2.0. Check the vendor advisory for mitigations.

References

• https://seclists.org/oss-sec/2010/q3/357
• https://www.usenix.org/legacy/events/woot10/tech/full_papers/Rizzo.pdf
• https://seclists.org/oss-sec/2010/q3/357
• https://www.usenix.org/legacy/events/woot10/tech/full_papers/Rizzo.pdf

Get alerted when CVE-2010-3300 or the next vulnerability affects your stack