DerScanner
Home / Vulnerability Database / C-sharp : Insecure data transmission via email
C#

C-sharp : Insecure data transmission via email

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic Failures
OWASP ASVS
Communication
PCI DSS 4.0
4.2.16.2.4
HIPAA
§164.312 (e)(1)§164.312 (e)(2)(ii)
CWE
CWE-1032

Overview

Using unencrypted connection when sending email messages allows an attacker to carry out a man in the middle attack. This can lead to a complete confidentiality loss of the transferred data.

Using HTTPS, which is based on HTTP and SSL / TLS, helps to protect the transferred data against unauthorized access and modification. It is recommended to use HTTPS for all cases of data transfer between the client and the server.

References

  1. SmtpClient.EnableSsl Property
  2. Transport Layer Protection Cheat Sheet - OWASP
  3. Web Security: Why You Should Always Use HTTPS - Mike Shema / Mashable
  4. OWASP Top 10 2017-A3-Sensitive Data Exposure
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
CRITICAL

DerScanner Severity Score

Do you want to fix C-sharp : Insecure data transmission via email in your application?

See also

C#

C-sharp : JWT: None Algorithm

C#

C-sharp : Insecure data transmission: Database

C#

C-sharp : Only one of method Equals() and GetHashCode() defined