search

wwesleyalves / bodgeit

0 stars 0 forks source link

CX Empty_Password_In_Connection_String @ root/dbconnection.jspf [main] #9

Closed wwesleyalves closed 1 year ago

wwesleyalves commented 1 year ago

Empty_Password_In_Connection_String issue exists @ root/dbconnection.jspf in branch main

The application uses the empty password """" for authentication purposes, either using it to verify users' identities, or to access another remote system. This empty password is set at line 10 of root\dbconnection.jspf appears in the code, cannot be changed without rebuilding the application and indicates its associated account is exposed.Similarity ID: 2126563164

Severity: Low

CWE:521

Vulnerability details and guidance

Checkmarx

Training Recommended Fix

Lines: 10

Code (Line #10):

conn = DriverManager.getConnection("jdbc:hsqldb:mem:SQL", "sa", "");
wwesleyalves commented 1 year ago

Issue still exists.

wwesleyalves commented 1 year ago

Issue still exists.