Detections
Analytics

Insecure Redirect Chain

medium Web App Scanning Plugin ID 113219

Language:

Synopsis

Insecure Redirect Chain

Description

The scanner encountered one or more insecure redirects during the application crawl which means the redirection chain is not fully done with HTTPS. During an insecure redirection anyone could establish a man-in-the-middle attack against the remote host.

Solution

It is necessary to perform redirects only to HTTPS sites. It is also recommended to add HTTP Strict Transport Security (HSTS) on the final URL.

Plugin Details

Severity: Medium

ID: 113219

Type: remote

Family: SSL/TLS

Published: 5/16/2024

Updated: 11/14/2024

Scan Template: api, basic, config_audit, full, pci, quick, scan, ssl_tls

Risk Information

VPR

Risk Factor: Low

Score: 3.3

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS Score Source: Tenable

Reference Information