CVE-2013-3734

6.6 mediumEPSS 1.6%

The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console

Severity

CVSS 3.0

6.6 medium

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-255
Published: 2017-10-24
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

redhat:jboss_application_server

References

http://www.securityfocus.com/bid/60429
https://bugzilla.redhat.com/show_bug.cgi?id=971637
https://www.halock.com/blog/cve-2013-3734-jboss-administration-console-password-returned-response/
http://www.securityfocus.com/bid/60429
https://bugzilla.redhat.com/show_bug.cgi?id=971637

Check your stack JSON