Weakness (CWE)
CWE-1428: Reliance on HTTP instead of HTTPS
The product provides or relies on use of HTTP communications when HTTPS is available.
How to prevent it (4 mitigations)
-
Architecture and Design
Unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption. Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].
-
Implementation
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.
-
Implementation, Operation
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.
-
Operation
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).
Source: MITRE CWE-1428
3 results · Clear filters · Feed
-
High 8.9
Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution
Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network …
-
High 7.0
PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support f…
-
High 7.7
The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle att…