---
title: "Weak Cipher Detection"
description: "HawkScan test information for plugin 500001: Weak Cipher Detection"
url: https://docs.stackhawk.com/vulnerabilities/500001/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# Weak Cipher Detection

###### Reference

- **Plugin ID:** 500001
- [**CWE:** 326](https://cwe.mitre.org/data/definitions/326.html)
- **WASC:** 4
- **Risk:** High
- **Type:** Passive
- **Category:**

###### Resource

- <https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html>

### Remediation

To address Weak Cipher Check - Insufficient Transport Layer Protection vulnerabilities in an OpenAPI specification, follow these steps:

1. **Enable Strong SSL/TLS Ciphers:** Ensure that only strong SSL/TLS ciphers are enabled for securing API communications. Define security requirements in the OpenAPI specification to enforce the use of modern cryptographic algorithms and key lengths.

   ```yaml
   servers:
     - url: https://api.example.com
       description: Secure API server (TLS/SSL)
   ```

2. **Disable Weak Ciphers:** Disable deprecated or weak SSL/TLS ciphers that are vulnerable to attacks. Specify in the OpenAPI specification the list of ciphers that should be avoided to prevent exploitation of cryptographic weaknesses.

3. **Enforce TLS Version:** Enforce the use of the latest TLS version to mitigate known vulnerabilities in older versions. Define minimum TLS version requirements in the OpenAPI specification to ensure secure transport layer protection.

### About

Weak Cipher Check - Insufficient Transport Layer Protection vulnerabilities arise when APIs use outdated or insecure SSL/TLS ciphers, exposing sensitive data to interception or tampering by attackers.

### Risks

The risks associated with Weak Cipher Check - Insufficient Transport Layer Protection vulnerabilities include data interception, man-in-the-middle attacks, and unauthorized access to sensitive information. Implementing strong SSL/TLS ciphers and enforcing secure transport layer configurations is crucial for protecting API communications from cryptographic weaknesses and security threats.