Queen of Information Disclosure
An attacker can read the entire channel because the channel (say, HTTP or SMTP) isn’t encrypted.
|
Threat |
|
|
|
Your API doesn’t require HTTPS and authentication is in cleartext, so an attacker is harvesting the credentials of your customers. |
|
CAPEC |
CAPEC-94 - Adversary in the Middle (AiTM) CAPEC-466 - Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy |
|
ASVS |
1.9.1 - Ensure you’re using TLS everywhere. 9.1.1 - Ensure the TLS version can’t be downgraded. |
|
CWE |
CWE-319 - Cleartext Transmission of Sensitive Information |
|
Mitigations |
|
