A vulnerability scan is run against a domain hosing a banking application that accepts connections over MTTPS and HTTP protocols Given the following results: · SSU3 supported · HSTS not enforced ·…

SSLv3 support exposes the server to the POODLE attack (CVE-2014-3566), which requires an active MITM position and multiple crafted requests to decrypt individual blocks - a more complex exploitation path than SSL stripping.

Without HTTP Strict Transport Security, a banking application that accepts HTTP connections is trivially vulnerable to SSL stripping, where a man-in-the-middle attacker downgrades the victim's HTTPS connection to unencrypted HTTP. This exposes credentials, session tokens, and financial transaction data entirely in plaintext with no cryptographic protection. HSTS enforcement would instruct browsers to always use HTTPS and reject downgrade attempts, making this the most critical control gap among the listed findings.

Weak ciphers raise the risk that captured ciphertext could eventually be decrypted, but successful exploitation still requires capturing traffic and significant computational resources.

Clickjacking allows UI redirection attacks that can trick users into unintended clicks or form submissions, but does not directly expose credentials or financial data transmitted in transit.