Weakness (CWE)
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it (2 mitigations)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
-
Implementation, System Configuration, Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Source: MITRE CWE-312
312 results · Clear filters · Feed
-
Medium 4.6
Cisco IP Phones Information Disclosure Vulnerability
A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confiden…
-
Medium 4.9
A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenti…
-
Medium 6.5
Instance config inline secret exposure
Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two end…
-
Medium 6.3
Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior …
-
Medium 4.9
Liferay Portal and Liferay DXP Stores User Passwords in Cleartext
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which a…
-
Medium 6.5
Client side sessions should not allow unencrypted storage
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session…
-
Medium 5.3
WAGO: Managed Switches: Storage of user credentials in a cookie
In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.
-
Medium 5.9
Cleartext storage of session identifier
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. Th…
-
Medium 4.4
SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
-
Medium 6.4
Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X…
-
Medium 5.5
Passwords stored in plain text by ElasTest Plugin
Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Medium 5.4
In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authenticat…
-
Medium 6.9
Client caching login operation with plaintext password in Saleor Storefront
In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and pa…
-
Medium 5.5
ActiveMQ Artemis has Insufficiently Protected Credentials
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local …
-
Medium 6.3
A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at re…
-
Medium 5.5
Grafana information disclosure
An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted dat…
-
Medium 4.3
Credentials stored in plain text by Jenkins Copr Plugin
Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.6
A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are st…
-
Medium 4.1
Katello cleartext password storage issue
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials …
-
Medium 5.3
Magento 2 Community Edition Weak Cryptography
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
-
Medium 4.3
Jenkins SOASTA CloudTest Plugin stores API token in plain text
Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins View26 Test-Reporting Plugin stores access token in plain text
Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Fortify on Demand Plugin stores credentials in plain text
Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Sofy.AI Plugin stores API token in plain text
Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.5
Centreon Sensitive Data Exposure
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
-
Medium 5.5
Jenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins Caliper CI Plugin stores credentials in plain text
Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Port Allocator Plugin stores credentials in plain text
Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Gogs Plugin stored credentials in plain text
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.5
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with acces…
-
Medium —CVE-2013-5676 Public exploit
Jenkins SonarQube Plugin Stores Passwords in Cleartext
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
-
Medium 5.7CVE-2011-4723 Exploited
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive info…
KEV Sep 8, 2022