King of Information Disclosure

An attacker can read network information because there’s no cryptography used.

Threat
	You haven’t architected for zero trust (an architecture to protect against bad actors that are already inside your network). For this reason, many of your internal applications use HTTP instead of HTTPS. Once inside your network, an attacker can just sit there with a packet sniffer and harvest credentials, emails, personal data, finance data, you name it. Wireshark can quite easily reconstruct the stream of packets so that you can glue a conversation back together.
CAPEC	CAPEC-94 - Adversary in the Middle (AiTM) CAPEC-157 - Sniffing Attacks CAPEC-158 - Sniffing Network Traffic
ASVS	1.9.1 - Ensure you’re using TLS everywhere...