CWE-319 Cleartext Transmission of Sensitive Information
What this means
SiteShadow flagged sensitive data being sent over an insecure channel (no TLS/HTTPS) or sent in a way that leaks in transit (e.g., query strings, mixed content).
Why it matters
Attackers can intercept credentials or tokens in transit.
- Token/session theft over shared networks or compromised routers.
- Credential compromise when passwords/API keys travel unencrypted.
- Content tampering: attackers can modify responses to inject malicious behavior.
Safer examples
1) Use HTTPS everywhere
- Redirect HTTP → HTTPS
- Enable HSTS
2) Never put secrets in URLs
Avoid tokens/passwords in query strings (they leak into logs and referrers). Use headers or POST bodies where appropriate.
3) Keep TLS verification enabled
Don't disable certificate checks to "make it work" (see T01 / CWE-295).
How SiteShadow detects it (high level)
- Flags use of
http://endpoints for sensitive operations and mixed-content patterns. - Detects credential-like data being placed into URLs or transmitted without secure transport settings.
References
- CWE-319: https://cwe.mitre.org/data/definitions/319.html
---