AppScan安全性问题：Unencrypted Login Request

[luxi0194]

Unencrypted Login Request
Severity: Medium
Type: Application-level test
WASC Threat Classification: Application Privacy Tests
CVE Reference(s): N/A
Security Risk: It may be possible to steal user login information such as usernames and passwords that are sent unencrypted

--------------------------------------------------------------------------------
Possible Causes
Sensitive input fields such as usernames, password and credit card numbers are passed unencrypted
Technical Description
During the application test, it was detected that an unencrypted login request was sent to the server. Since some of the input fields used in a login process (for example: usernames, passwords, email addresses, social security number, etc.) are personal and sensitive, it is recommended that they will be sent to the server over an encrypted connection (e.g. SSL).
Any information sent to the server as clear text, may be stolen and used later for identity theft or user impersonation.

In addition, several privacy regulations state that sensitive information such as user credentials will always be sent encrypted to the web site.
Affected Products
This issue may affect different types of products
References and Relevant Links
Financial Privacy: The Gramm-Leach Bliley Act
Health Insurance Portability and Accountability Act (HIPAA)
Sarbanes-Oxley Act
California SB1386

[luxi0194]

而在页面上 <form id="form1" runat="server" onsubmit="txtMima.value =hex_md5(txtMima.value)">页面submit的时候已经对密码进行了加密了。。。

[luxi0194]

扫描的时候还是会出现这个问题。。。