DerScanner
Home / Vulnerability Database / HTML5 : Password transfer via GET form
HTML5

HTML5 : Password transfer via GET form

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure Design
PCI DSS 4.0
6.2.48.3.2
HIPAA
§164.312 (e)(1)
CWE
CWE-598CWE-1032

Overview

The application uses a form to enter the password, which is passed by the GET method. When using GET requests, the parameters entered by the user are sent to the server as part of the URL, not in the body of the request. Such GET request can be cached by servers or intermediate proxy servers, thus privacy violation is possible.

References

  1. CWE-359: Exposure of Private Information (‘Privacy Violation’)
  2. OWASP Top 10 2013-A6-Sensitive Data Exposure
  3. CWE-598: Information Exposure Through Query Strings in GET Request
  4. Top 10-2017 A3-Sensitive Data Exposure
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MEDIUM

DerScanner Severity Score

Do you want to fix HTML5 : Password transfer via GET form in your application?

See also

HTML5

HTML5 : Missing required cryptographic step

HTML5

HTML5 : Weak hashing algorithm

HTML5

HTML5 : Cross-site request forgery (CSRF)