Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
Weakness
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Active_support_connectivity_gateway | Brocade | * | 3.2.0 (excluding) |