PT-2017-5475 · Red Hat · Jboss Application Server

Cindy Kaplan · Publicado 2017-10-24 · Atualizado 2024-08-06 · CVE-2013-3734

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: JBoss Application Server (affected versions not specified)

Description: The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses. This might allow man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or attackers to obtain sensitive information by reading the HTML source code. The vendor notes that this does not cross a trust boundary and recommends configuring SSL for the administrative console as best practice.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2013-3734

Produtos afetados

Jboss Application Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-3734 · Nota de Segurança
• https://t.me/cvenotify/89467 · Publicação no Telegram
• https://halock.com/blog/cve-2013-3734-jboss-administration-console-password-returned-response · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=971637 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3734 · Nota
• http://securityfocus.com/bid/60429 · Nota