CVE-2013-3734: Medium severity red hat jboss application server vulnerability
DISPUTED The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console.
Other sources
The datasource password is contained in the response received by an authenticated administraive user. If SSL is not configured/used, this password may be exposed on the wire.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3734?
CVE-2013-3734 is considered a high severity vulnerability due to the exposure of sensitive information.
How do I fix CVE-2013-3734?
To fix CVE-2013-3734, you should upgrade to a version of JBoss Application Server that no longer includes cleartext passwords in HTML responses.
What types of attacks can exploit CVE-2013-3734?
CVE-2013-3734 can be exploited by man-in-the-middle attackers who intercept unencrypted traffic and obtain sensitive information.
Which versions of JBoss Application Server are affected by CVE-2013-3734?
CVE-2013-3734 affects all versions of JBoss Application Server up to and including 1.2.
What kind of sensitive information is exposed in CVE-2013-3734?
CVE-2013-3734 exposes the datasource password in cleartext, which can lead to unauthorized access.