1231
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 255 Credentials Management Errors 2315
Background Details
SSL (Secure Socket Layer) provides data confidentiality and integrity to HTTP. By encrypting HTTP
messages, SSL protects from attackers eavesdropping or altering message contents.
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Operation
Phase: System Configuration
Enforce SSL use for the login page or any page used to transmit user credentials or other
sensitive information. Even if the entire site does not use SSL, it MUST use SSL for login.
Additionally, to help prevent phishing attacks, make sure that SSL serves the login page. SSL
allows the user to verify the identity of the server to which they are connecting. If the SSL serves
login page, the user can be certain they are talking to the proper end system. A phishing attack
would typically redirect a user to a site that does not have a valid trusted server certificate issued
from an authorized supplier.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 930 OWASP Top Ten 2013 Category A2 - Broken
Authentication and Session Management
928 2389
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP23 Exposed Data
CWE Version 4.14
CWE-524: Use of Cache Containing Sensitive Information
CWE-524: Use of Cache Containing Sensitive Information