Weakness (CWE)
CWE-1428: Reliance on HTTP instead of HTTPS
The product provides or relies on use of HTTP communications when HTTPS is available.
How to prevent it (4 mitigations)
-
Architecture and Design
Unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption. Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].
-
Implementation
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.
-
Implementation, Operation
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.
-
Operation
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).
Source: MITRE CWE-1428
1 result · Clear filters · Feed
-
Medium 6.0
Cleartext Transmission of Sensitive Information in mH-DEVELOPER
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and…