CVE-2013-3734
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2)…
Does this matter?
Lower severity and a low EPSS score (1.58%). Track it; it rarely justifies an emergency change on its own.
Description
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console
- CVSS 3.0
- 6.6 MEDIUMCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.58% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- redhat/jboss application server
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/60429Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=971637Issue Tracking, Vendor Advisory
- https://www.halock.com/blog/cve-2013-3734-jboss-administration-console-password-returned-response/Issue Tracking, Third Party Advisory
- http://www.securityfocus.com/bid/60429Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=971637Issue Tracking, Vendor Advisory
- https://www.halock.com/blog/cve-2013-3734-jboss-administration-console-password-returned-response/Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.