Anonymous Ciphers Supported
Severity: Medium
Summary
Netsparker detected that anonymous ciphers is supported during secure communication (SSL).
You should allow only strong ciphers on your web server to protect your secure communication with your visitors.
Impact
Attackers can perform man-in-the middle attacks and observe the encrypted traffic between your website and your visitors.
Actions To Take
- Configure your web server to disallow using anonymous ciphers.
For Apache, you should modify the SSLCipherSuite directive in thehttpd.conf.
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
Classifications
PCI v3.1-6.5.4, PCI v3.2-6.5.4, CAPEC-117, WASC-4, OWASP 2013-A6
, CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
