CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption
Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
View on MITRETechnical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
Scope
Impact
Mitigation Strategies
Phase
Description
The product configuration should ensure that SSL or an encryption mechanism of equivalent strength and vetted reputation is used for all access-controlled pages.
Detection Methods
No detection method information available for this CWE.
Code Examples & CVEs
No examples or observed CVEs available for this CWE.
CWE Relationships
Frequently Asked Questions
What is CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption?+
CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
What are the security consequences of J2EE Misconfiguration: Data Transmission Without Encryption?+
If exploited, CWE-5 (J2EE Misconfiguration: Data Transmission Without Encryption) it can compromise Confidentiality and Integrity, leading to outcomes such as Read Application Data and Modify Application Data.
How do you prevent or mitigate J2EE Misconfiguration: Data Transmission Without Encryption?+
Recommended mitigations for CWE-5 include: The product configuration should ensure that SSL or an encryption mechanism of equivalent strength and vetted reputation is used for all access-controlled pages.
Which programming languages are affected by J2EE Misconfiguration: Data Transmission Without Encryption?+
CWE-5 commonly affects Java. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-5 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.