7. of Spoofing II
An attacker can connect to a server or peer over a link that isn’t authenticated (and encrypted).
|
Threat |
|
|
|
The attacker could use the unencrypted version of a protocol such as HTTP instead of HTTPS to connect to the machine. |
|
CAPEC |
CAPEC-94 - Adversary in the Middle (AiTM) |
|
ASVS |
1.9.1 - Ensure you’re using TLS everywhere 9.1.1 - Ensure the TLS version can’t be downgraded |
|
CWE |
CWE-319 - Cleartext Transmission of Sensitive Information |
|
Mitigations |
|
|
|
|
