Cleartext Transmission of Sensitive Data

Sending credentials or personal data without encryption, readable by anyone on the path.

Specifications & Metrics

cwe

CWE-319

impact

High

Core Principles & Analysis

• Plain HTTP, unencrypted FTP and legacy protocols expose entire sessions.
• Network-level attackers need no exploit — only a listening socket.
• TLS everywhere plus HSTS is the standing remedy.