Detections
Analytics

Mixed Resource Detection

medium Web App Scanning Plugin ID 98091

Language:

Synopsis

Mixed Resource Detection

Description

Scanner discovered that the affected site is utilising both HTTP and HTTPS. While the HTML code is served over HTTPS, the server is also serving resources over an unencrypted channel, which can lead to the compromise of data, while providing a false sense of security to the user.

Solution

All pages and/or resources on the affected site should be secured equally, utilising the latest and most secure encryption protocols. These include SSL version 3.0 and TLS version 1.2.
While TLS 1.2 is the latest and the most preferred protocol, not all browsers will support this encryption method. Therefore, the more common SSL is included. Older protocols such as SSL version 2, and weak ciphers (< 128 bit) should also be disabled.

See Also

http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html

https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content

Plugin Details

Severity: Medium

ID: 98091

Type: remote

Published: 3/31/2017

Updated: 11/26/2021

Scan Template: basic, config_audit, full, overview, pci, quick, scan, ssl_tls

Risk Information

VPR

Risk Factor: Low

Score: 3.3

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS Score Source: Tenable

Reference Information