Details
Alert ID 10040
Alert Type Passive
Status release
Risk Low
CWE 311
WASC 4
Technologies Targeted All
Tags CWE-311
OWASP_2017_A06
OWASP_2021_A05
POLICY_DEV_STD
POLICY_PENTEST
POLICY_QA_STD
SYSTEMIC
WSTG-V42-CRYP-03
More Info Scan Rule Help

Summary

The page includes mixed content, that is content accessed via HTTP instead of HTTPS.

Solution

A page that is available over SSL/TLS must be comprised completely of content which is transmitted over SSL/TLS. The page must not contain any content that is transmitted over unencrypted HTTP. This includes content from third party sites.

Other Info

tag=img src=http://example.com/file

References

Code

org/zaproxy/zap/extension/pscanrules/MixedContentScanRule.java