DerScanner
Home / Vulnerability Database / Objective-C : HTTP usage
Objective-C

Objective-C : HTTP usage

Classification

OWASP Mobile Top 10 2016
M3-Insecure CommunicationM2-Insecure Data StorageM5-Insufficient Cryptography
OWASP Top 10 2017
A3-Sensitive Data ExposureA6-Security Misconfiguration
OWASP Top 10 2021
A2-Cryptographic FailuresA5-Security Misconfiguration
OWASP MASVS
V5: 5.1.(L1/L2/L1+R/L2+R)
OWASP ASVS
Communication
PCI DSS 4.0
4.2.16.2.4
HIPAA
§164.312 (e)(1)§164.312 (e)(2)(ii)
CWE
CWE-200CWE-319CWE-359CWE-1032
CWE/SANS Top 25 2021
CWE-200

Overview

Using HTTP rather than HTTPS allows man in the middle attack. This may lead to a complete confidentiality loss of the transferred data.

Using HTTPS, which is based on HTTP and SSL / TLS, helps to protect the transferred data against unauthorized access and modification. It is recommended to use HTTPS for all cases of data transfer between the client and the server, in particular, for the login page and all pages that require authentication.

References

  1. Transport Layer Protection Cheat Sheet – OWASP
  2. Web Security: Why You Should Always Use HTTPS – Mike Shema / Mashable/
  3. UIApplication openURL: - developer.apple.com
  4. OWASP Mobile Top 10 2016-M3-Insecure Communication
  5. CWE-319: Cleartext Transmission of Sensitive Information
MEDIUM

DerScanner Severity Score

Do you want to fix Objective-C : HTTP usage in your application?

See also

Objective-C

Objective-C : Internal information leak

Objective-C

Objective-C : Weak hashing algorithm

Objective-C

Objective-C : Unsafe reflection