COMMON WEAKNESS ENUMERATIONDraft

CWE-5

J2EE Misconfiguration: Data Transmission Without Encryption

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Lifecycle phase

Operation

Risk

What does successful exploitation lead to?

Read Application Data

Affected security scopes: Confidentiality

Modify Application Data

Affected security scopes: Integrity

Defence

How is it prevented and fixed?

System Configuration

Secure configuration approach

Detail
The product configuration should ensure that SSL or an encryption mechanism of equivalent strength and vetted reputation is used for all access-controlled pages.