Summary

Netsparker detected that insecure transportation security protocol (SSLv3) is supported by your web server.

SSLv3 has several flaws. An attacker can cause connection failures and they can trigger the use of SSL 3.0 to exploit vulnerabilities like POODLE.

Impact
Attackers can perform man-in-the-middle attacks and observe the encryption traffic between your website and its visitors.
Remediation

Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.

  • For Apache, adjust the SSLProtocol directive provided by the mod_ssl module. This directive can be set either at the server level or in a virtual host configuration.
    SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
    
  • For Nginx, locate any use of the directive ssl_protocols in the nginx.conf file and remove SSLv3.
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    
  • For Microsoft IIS, you should make some changes on the system registry.
    1. Click on Start and then Run, type regedt32 or regedit, and then click OK.
    2. In Registry Editor, locate the following registry key or create if it does not exist:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\
      
    3. Locate a key named Server or create if it doesn't exist.
    4. Under the Server key, locate a DWORD value named Enabled or create if it doesn't exist and set its value to "0".
  • For Lighttpd, put the following lines in your configuration file:
    ssl.use-sslv2 = "disable"
    ssl.use-sslv3 = "disable"
    
Classifications
PCI v3.1-6.5.4, PCI v3.2-6.5.4, CAPEC-217, WASC-4, OWASP 2013-A6 , CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C