VariantDraft

CWE-5J2EE Misconfiguration: Data Transmission Without Encryption

Category: data-exposure

Description

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Common consequences· 2

  • Confidentiality — Read Application Data
  • Integrity — Modify Application Data

Potential mitigations· 1

  • [System Configuration]The product configuration should ensure that SSL or an encryption mechanism of equivalent strength and vetted reputation is used for all access-controlled pages.

References

  1. https://cwe.mitre.org/data/definitions/5.html

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CWE
J2EE Misconfiguration: Plaintext Password in Configuration File
CWE
J2EE Misconfiguration: Entity Bean Declared Remote
CWE
J2EE Misconfiguration: Missing Custom Error Page
CWE
J2EE Misconfiguration: Insufficient Session-ID Length
CWE
J2EE Misconfiguration: Weak Access Permissions for EJB Methods
CWE
Java Runtime Error Message Containing Sensitive Information
Sourced from MITRE CWE 4.20. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.