CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption
J2EE Misconfiguration: Data Transmission Without Encryption
Weakness ID: 5 (Weakness Variant)
Status: Draft
Description
Description Summary
Information sent over a network can be compromised while in transit. An attacker may be able to read/modify the contents if the data are sent in plaintext or are weakly encrypted.
Time of Introduction
Implementation
Operation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Confidentiality
Integrity
Technical Impact: Read application
data; Modify application
data
Potential Mitigations
The application configuration should ensure that SSL or an encryption
mechanism of equivalent strength and vetted reputation is used for all
access-controlled pages.
Other Notes
If an application uses SSL to guarantee confidential communication with
client browsers, the application configuration should make it impossible to
view any access controlled page without SSL. There are three common ways for
SSL to be bypassed:
A user manually enters URL and types "HTTP" rather than
"HTTPS".
Attackers intentionally send a user to an insecure URL.
A programmer erroneously creates a relative link to a page in the
application, which does not switch from HTTP to HTTPS. (This is
particularly easy to do when the link moves between public and secured
areas on a web site.)
Description
