Download Netsparker
Pricing
Blog
Contact
Netsparker

Anonymous Ciphers Allowed by Target Web Server

Netsparker detected that anonymous ciphers is supported during secure communication (SSL).

You should allow only strong ciphers on your web server to protect your secure communication with your visitors.

Impact

Attackers can perform man-in-the middle attacks and observe the encrypted traffic between your website and your visitors.

Actions to Take

  1. Configure your web server to disallow using anonymous ciphers.

    For Apache, you should modify the SSLCipherSuite directive in the httpd.conf.

    SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

External References


Go back to the Complete list of Vulnerability Checks.