DerScanner
Home / Vulnerability Database / PHP : HTTP usage
PHP

PHP : HTTP usage

Classification

OWASP Mobile Top 10 2016
M3-Insecure CommunicationM2-Insecure Data StorageM5-Insufficient Cryptography
OWASP Top 10 2017
A3-Sensitive Data ExposureA6-Security Misconfiguration
OWASP Top 10 2021
A2-Cryptographic FailuresA5-Security Misconfiguration
OWASP MASVS
V5: 5.1.(L1/L2/L1+R/L2+R)
OWASP ASVS
Communication
PCI DSS 4.0
4.2.16.2.4
HIPAA
§164.312 (e)(1)§164.312 (e)(2)(ii)
CWE
CWE-200CWE-319CWE-359CWE-1032
CWE/SANS Top 25 2021
CWE-200

Overview

Using HTTP rather than HTTPS allows a man in the middle (MitM) attack. This can lead to a complete loss of confidentiality of the transmitted data.

HTTPS is a protocol based on HTTP and SSL / TLS that helps to protect the transmitted data against unauthorized access and modification. It is recommended to use HTTPS for all cases of data transfer between the client and the server, in particular, for the login page and all pages that require authentication.

References

  1. OWASP Top 10 2017-A3-Sensitive Data Exposure
  2. Transport Layer Protection Cheat Sheet – OWASP
  3. Web Security: Why You Should Always Use HTTPS – Mike Shema / Mashable
  4. CWE-319: Cleartext Transmission of Sensitive Information
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MEDIUM

DerScanner Severity Score

Do you want to fix PHP : HTTP usage in your application?

See also

PHP

PHP : Null salt

PHP

PHP : Empty password

PHP

PHP : Empty salt