search

KOLsecurity / Remote-user-

web application
0 stars 0 forks source link

Acunetix - User credentials are sent in clear text #1

Open KOLsecurity opened 6 years ago

KOLsecurity commented 6 years ago
Target URL http://192.168.1.174:8089/RemoteUser/login?sessionTerminate=success
Severity Medium
Vulnerability Description

User credentials are transmitted over an unencrypted channel. This information should always be transferred via an encrypted channel (HTTPS) to avoid being intercepted by malicious users.

Attack Details

Not available in the free trial

HTTP Request
Not available in the free trial
Impact

A third party may be able to read the user credentials by intercepting an unencrypted HTTP connection.

Remediation

Because user credentials are considered sensitive information, should always be transferred to the server over an encrypted connection (HTTPS).

bossdong886 commented 2 years ago

how do you issue it?