Hi Mitul,
I'm assuming you ran a vulnerability scan against the MWG's forward proxy port (e.g. 9090) correct? If so, then this can likley be ignored.
Here is the reason.
MWG is the device that clients connect to, to get to the internet (as a forward proxy). They establish the handshake with the MWG (inside your network). The MWG will then establish it's own handshake to the outside world with the server.
In that scenario, it shouldnt really matter what type of handshake is used between the client and the MWG because this happens in side the network. As a result, MWG will offer a lot of cipher suites in order to be compatible with a large number of client types (old or new).
What matters is the handshake between the MWG and the outside world. In that handshake MWG will use the most secure method available to protect the communication.
In effect the client and the MWG could have a very old and unsecure handshake, but the MWG to the server could have the highest possible cipher method and TLS version supported.
If you are using MWG as a reverse proxy then this story changes, because the client would be in the outside world.
Best,
Jon
