What is the CVSS score of CVE-2013-3734?

CVE-2013-3734 has a CVSS 3.0 base score of 6.6 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Jboss Application Server CVE-2013-3734

MEDIUM

Credentials Management Errors (CWE-255)

2017-10-24 cve@mitre.org

Authentication Bypass Jboss Application Server

6.6

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 24, 2017 - 15:29 cve.org

MEDIUM 6.6

DescriptionCVE.org

The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-255. The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console Affected products include: Redhat Jboss Application Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.