Skip to main content

Insecure encryption algorithm - SSL/TLS

Description​

The server allows the usage of insecure TLS protocol versions.

Impact​

Compromise sensitive information that travels between client and server.

Recommendation​

Update TLS protocol to version TLSv1.2 or TLSv1.3 if possible.

Threat​

Unauthorized attacker from adjacent network.

Expected Remediation Time​

⌚ minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the src.

Base​

  • Attack vector: A
  • Attack complexity: H
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal​

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: R

Result​

  • Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:R
  • Score:
    • Base: 2.6
    • Temporal: 2.3
  • Severity:
    • Base: Low
    • Temporal: Low

Details​

SSL (Secure Sockets Layer) and its successor, TLS (Transport Layer Security), are protocols for establishing authenticated and encrypted links between networked computers.

The most common and well-known use of SSL/TLS is secure web browsing via the HTTPS protocol. Users visiting an HTTPS website can be assured of:

  • Authenticity, The server presenting the certificate is in possession of the private key that matches the public key in the certificate.

  • Integrity, Documents signed by the certificate (e.g. web pages) have not been altered in transit by a man in the middle.

  • Encryption, Communications between the client and server are encrypted.

Because of these properties, SSL/TLS and HTTPS allow users to securely transmit confidential information such as credit card numbers, social security numbers, and login credentials over the internet, and be sure that the website they are sending them to is authentic.

With an insecure HTTP website, these data are sent as plain text, readily available to any eavesdropper with access to the data stream. Furthermore, users of these unprotected websites have no trusted third-party assurance that the website they are visiting is what it claims to be.

Requirements​

Fixes​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.

Last updated on