Insecure Transport - Revision history

Imifos: category correction

2016-02-02T14:35:00Z

category correction

2015-12-01T13:03:25Z

2009-02-26T11:26:41Z

‎Related Attacks

2009-02-26T11:26:15Z

‎Description

2009-02-21T01:27:59Z

2009-02-18T02:34:07Z

2009-02-17T16:43:47Z

2008-11-02T20:41:03Z

2008-09-26T17:22:57Z

2006-07-21T18:08:54Z

Added contents from Fortify.

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 [[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
@@ Line 86: / Line 83: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Deployment]]
-[[Category:OWASP Java Project]]
+[[Category:Java]]
 [[Category:Environmental Vulnerability]]
 [[Category:Communication]]
 [[Category:SSL]]
 [[Category:Vulnerability]]

@@ Line 86: / Line 86: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Deployment]]
-[[Category:Java]]
+[[Category:OWASP Java Project]]
 [[Category:Environmental Vulnerability]]
 [[Category:Communication]]
 [[Category:SSL]]
 [[Category:Vulnerability]]

@@ Line 29: / Line 29: @@
 ==Related [[Attacks]]==
-* Attackers that are trying to steal login credentials, session ids or other sensitive information
+* Attackers that are trying to steal login credentials, session IDs or other sensitive information
 * Bypassing SSL by entering HTTP instead of HTTPS
 * Sending insecure URLs of protected pages to the victim (e.g. login page) to trick the victim into accessing the privileged pages via HTTP
 ==Related [[Vulnerabilities]]==

@@ Line 7: / Line 7: @@
 ==Description==
 The application configuration should ensure that SSL is used for all access controlled pages.
-If an application uses SSL to guarantee confidential communication with client browsers, the application configuration should make it impossible to view any access controlled page without SSL. However, it is not a uncommon problem that the configuration of the application fails to enforce the use of SSL on pages that contain sensitive data.
+If an application uses SSL to guarantee confidential communication with client browsers, the application configuration should make it impossible to view any access controlled page without SSL. However, it is not an uncommon problem that the configuration of the application fails to enforce the use of SSL on pages that contain sensitive data.
 There are three common ways for SSL to be bypassed:
-* A user manually enters URL and types "HTTP" rather than "HTTPS"
+* A user manually enters the URL and types "HTTP" rather than "HTTPS".
-* Attackers intentionally send a user to an insecure URL
+* Attackers intentionally send a user to an insecure URL.
 * A programmer erroneously creates a relative link to a page in the application, failing to switch from HTTP to HTTPS. (This is particularly easy to do when the link moves between public and secured areas on a web site.)
 ==Risk Factors==

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 ==Description==

← Older revision	Revision as of 16:43, 17 February 2009
(No difference)

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 If an application uses SSL to guarantee confidential communication with client browsers, the application configuration should make it impossible to view any access controlled page without SSL. However, it is not a uncommon problem that the configuration of the application fails to enforce the use of SSL on pages that contain sensitive data.
@@ Line 16: / Line 24: @@
 * A programmer erroneously creates a relative link to a page in the application, failing to switch from HTTP to HTTPS. (This is particularly easy to do when the link moves between public and secured areas on a web site.)
 ==Examples ==
 * Login pages are not SSL protected
 * A publicly accessible page contains a relative link to a protected page which forgets to switch to SSL.
-==Related Threats==
 * Attackers that are trying to steal login credentials, session ids or other sensitive information
-==Related Attacks==
+* [[Control 1]]
-==Related Vulnerabilities==
+==Related [[Technical Impacts]]==
-==Related Countermeasures==
+__NOTOC__
 [[Category:Deployment]]
 [[Category:Java]]
 [[Category:Environmental Vulnerability]]
 [[Category:Communication]]
 [[Category:SSL]]