Inadequate Encryption Strength

Property
Language
Severity
CWE	CWE-326: Inadequate Encryption Strength
OWASP	A03:2017 - Sensitive Data Exposure
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Low

Description#

The MySQL server is configured to allow outdated TLS versions (TLS 1.0 or 1.1), which have known security weaknesses and are no longer considered secure for encrypting data in transit. This exposes connections to potential eavesdropping and attacks.

Impact#

If exploited, attackers could intercept or manipulate sensitive data transmitted between the application and the MySQL server. This may lead to data breaches, credential theft, or unauthorized access, putting both user data and organizational assets at risk.