A plugin calling an external endpoint over plain HTTP

Plugin code sends outbound calls over plaintext HTTP.

A plugin's compiled code calls an external endpoint over plain http, so the payload crosses the network unencrypted. Nothing in the admin surface shows the scheme.

It is the same weakness as a registered endpoint on a plaintext URL, arriving through compiled code instead of a registration, and harder to notice for exactly that reason. It usually reflects an internal or test endpoint that was never moved to TLS. Only literal destinations are detectable, so the list is a floor rather than a complete inventory.

Same problem as finding the call at all: the scheme lives in compiled code, so no admin screen shows it. Decompile the assembly or search its source for http:// destinations. Only literal destinations are visible, so treat the result as a floor.

Change the call to https, redeploy the assembly, and rotate any credential it has already sent in the clear.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for SC.L2-3.13.8 (Level 2: use cryptographic mechanisms to prevent disclosure of CUI in transmission), for the Dataverse system in your assessment scope. The same weakness as a registered endpoint on a plain http URL, arriving through compiled code instead of a registration, and harder to notice for exactly that reason: nothing in any admin surface shows the scheme. Only destinations written as literals are detected, so the list is a floor rather than a complete inventory.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A credential stored in a plugin step's unsecure configuration
• A webhook or service endpoint using plaintext HTTP
• A webhook registered without any authentication
• An HTTP-triggered flow anyone with the URL can run