Summary #

Netsparker detected that password data is being transmitted over HTTP.

Impact #
If an attacker can intercept network traffic, he/she can steal users' credentials.
Actions To Take #
  1. See the remedy for solution.
  2. Move all of your critical forms and pages to HTTPS and do not serve them over HTTP.
Remediation #
All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input, starting from the login process, should only be served over HTTPS.
Classifications #
PCI v3.1-6.5.4, PCI v3.2-6.5.4, CAPEC-65, CWE-319, ISO27001-A.14.1.3, WASC-4, OWASP 2013-A6, OWASP 2017-A3 , CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

GET A DEMO