|
|
|
|
|
|
|
| |
Web Server Uses Plain Text Authentication Forms |
|
| This script is Copyright (C) 2007-2010 Tenable Network Security, Inc. |
|
|
| Family | Web Servers |
| Nessus Plugin ID | 26194 (www_clear_text_passwords.nasl) |
| Bugtraq ID |
|
| CVE ID |
|
|
| Description: |
Synopsis :
The remote web server might transmit credentials in cleartext.
Description :
The remote web server contains several HTML form fields containing
an input of type 'password' which transmit their information to
a remote web server in cleartext.
An attacker eavesdropping the traffic between web browser and
server may obtain logins and passwords of valid users.
Solution :
Make sure that every sensitive form transmits content over HTTPS.
Risk factor :
Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
|
|
|
|
|
|
