Weakness (CWE)
CWE-1428: Reliance on HTTP instead of HTTPS
The product provides or relies on use of HTTP communications when HTTPS is available.
How to prevent it (4 mitigations)
-
Architecture and Design
Unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption. Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].
-
Implementation
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.
-
Implementation, Operation
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.
-
Operation
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).
Source: MITRE CWE-1428
5 results · Feed
-
High 8.9
Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution
Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network …
-
Low 2.3
Lack of traffic encryption in Płatnik
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 334 in version 10.0…
-
Medium 6.0
Cleartext Transmission of Sensitive Information in mH-DEVELOPER
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and…
-
High 7.0
PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support f…
-
High 7.7
The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle att…