Summary

Netsparker detected that weak ciphers are enabled during secure communication (SSL).

You should allow only strong ciphers on your web server to protect secure communication with your visitors.

Impact
Attackers might decrypt SSL traffic between your server and your visitors.
Actions To Take
  1. For Apache, you should modify the SSLCipherSuite directive in the httpd.conf.
    SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
    
  2. For Microsoft IIS, you should make some changes to the system registry.

    Click Start, click Run, type regedt32 or type regedit, and then click OK.

    In Registry Editor, locate the following registry key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders

    Set "Enabled" DWORD to "0x0" for the following registry keys:

    SCHANNEL\Ciphers\DES 56/56
    SCHANNEL\Ciphers\RC4 64/128
    SCHANNEL\Ciphers\RC4 40/128
    SCHANNEL\Ciphers\RC2 56/128
    SCHANNEL\Ciphers\RC2 40/128
    SCHANNEL\Ciphers\NULL
    SCHANNEL\Hashes\MD 
Remediation
Configure your web server to disallow using weak ciphers.
Classifications
PCI v3.1-6.5.4, PCI v3.2-6.5.4, CAPEC-217, WASC-4, OWASP 2013-A6 , CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N