CWE-5 describes a J2EE application that sends data across a network without encryption, or with encryption weak enough to be broken. The result is simple. Whoever sits on the path between the client and the server can read the traffic, and in some cases rewrite it.
This one hits Java web applications that run on a servlet container or application server, where transport security is a deployment setting rather than something the code does on its own. That makes it easy to miss. The code works, the tests pass, and the traffic is still plaintext.
How it happens
In J2EE, whether a page or service is reached over HTTPS is usually decided in configuration, not in Java code. If the deployment descriptor never asks for a secure transport, the container will happily serve the same content over plain HTTP.
Common ways this goes wrong:
- A login form or API endpoint is reachable on an HTTP port because nobody required HTTPS for that path.
- TLS is turned on at the front door but the hop between the proxy and the application is plaintext.
- An old protocol or cipher setting stays enabled, so the connection is encrypted but weakly.
What an attacker gains
MITRE lists two consequences. The attacker can read application data, and the attacker can modify application data. Both follow from the same fact: plaintext on a network can be observed and altered by anyone who can see it. Session cookies, credentials and form contents are all in scope.
How to find it
Start with the deployment descriptor and the container's connector settings. Look for paths that do not require a secure transport. Then test from the outside: request key pages over HTTP and see whether they answer instead of redirecting or refusing.
How to fix it
- Require a secure transport for every protected resource in the deployment descriptor.
- Redirect or refuse plain HTTP rather than serving it.
- Encrypt internal hops too, not just the public edge.
- Disable weak protocol versions and ciphers on the server.
Quick check
Is HTTPS at the load balancer enough?
Only for the hop it covers. If traffic from the balancer to the application server is plaintext, anyone with access to that network segment can still read it.
