PT-2017-5475 · Red Hat · Jboss Application Server

Cindy Kaplan · Published 2017-10-24 · Updated 2024-08-06 · CVE-2013-3734

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: JBoss Application Server (affected versions not specified)

Description: The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses. This might allow man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or attackers to obtain sensitive information by reading the HTML source code. The vendor notes that this does not cross a trust boundary and recommends configuring SSL for the administrative console as best practice.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-3734

Affected Products

Jboss Application Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-3734 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=971637 · Vendor Advisory
• https://t.me/cvenotify/89467 · Telegram Post
• https://halock.com/blog/cve-2013-3734-jboss-administration-console-password-returned-response · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3734 · Note
• http://securityfocus.com/bid/60429 · Note