Weakness (CWE)
CWE-1428: Reliance on HTTP instead of HTTPS
The product provides or relies on use of HTTP communications when HTTPS is available.
How to prevent it (4 mitigations)
-
Architecture and Design
Unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption. Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].
-
Implementation
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.
-
Implementation, Operation
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.
-
Operation
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).
Source: MITRE CWE-1428
1 result · Clear filters · Feed
-
Low 2.3
Lack of traffic encryption in Płatnik
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 334 in version 10.0…