CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption
J2EE Misconfiguration: Data Transmission Without Encryption
Weakness ID: 5 (Weakness Variant)
Status: Draft
Description
Description Summary
Information sent over a network can be compromised while in
transit. An attacker may be able to read/modify the contents if the data are
sent in plaintext or are weakly encrypted.
Time of Introduction
Implementation
Operation
Applicable Platforms
Languages
Java
Potential Mitigations
Phase
Description
The application configuration should ensure that SSL or an encryption
mechanism of equivalent strength and vetted reputation is used for all
access-controlled pages.
Other Notes
If an application uses SSL to guarantee confidential communication with
client browsers, the application configuration should make it impossible to
view any access controlled page without SSL. There are three common ways for
SSL to be bypassed: - (1) A user manually enters URL and types "HTTP" rather
than "HTTPS". - (2) Attackers intentionally send a user to an insecure URL.
- (3) A programmer erroneously creates a relative link to a page in the
application, failing to switch from HTTP to HTTPS. (This is particularly
easy to do when the link moves between public and secured areas on a web
site.)
Description
