...
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Coverity | 7.5 | HARDCODED_CREDENTIALS | Implemented | ||||||
| Fortify | 1.0 | Password_Management | Partially implemented | ||||||
| Parasoft Jtest | 9.5 | SECURITY.WSC.HCCS, SECURITY.WSC.HCCK, SECURITY.WSC.AHCA | Implemented | ||||||
| PMD | 1.0 | AvoidUsingHardCodedIP | Partially implemented | ||||||
| SonarQube Plugin |
| S1313 | Partially implemented |
Related Vulnerabilities
GERONIMO-2925 describes a vulnerability in the WAS CE tool, which is based on Apache Geronimo. It uses the Advanced Encryption Standard (AES) to encrypt passwords but uses a hard-coded key that is identical for all the WAS CE server instances. Consequently, anyone who can download the software is provided with the key to every instance of the tool. This vulnerability was resolved by having each new installation of the tool generate its own unique key and use it from that time on.
...