Skip to content

Cleartext communication over HTTP

Description

Detected use of HTTPConnectionPool, which transmits data in plaintext. This can expose sensitive data to man-in-the-middle (MITM) attacks.

Examples

Insecure Code

python
import urllib3
pool = urllib3.connectionpool.HTTPConnectionPool("example.com")

Secure Code

python
import urllib3
pool = urllib3.connectionpool.HTTPSConnectionPool("example.com")

Remediation

Use HTTPSConnectionPool to ensure encrypted communication.

Rule Details

FieldValue
IDCODE-0509
CategoryInsecureConfig
SeverityMEDIUM
CWECWE-319
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagsman-in-the-middle, MITM, cleartext
OWASPA02:2021-Cryptographic Failures