Weakness (CWE)
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it (2 mitigations)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
-
Implementation, System Configuration, Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Source: MITRE CWE-312
570 results · Feed
-
Medium 5.4
In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authenticat…
-
Medium 6.9
Client caching login operation with plaintext password in Saleor Storefront
In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and pa…
-
Medium 5.5
ActiveMQ Artemis has Insufficiently Protected Credentials
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local …
-
Unscored —
A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and …
-
Critical 9.9
C•CURE 9000 and victor Video Management System - Cleartext storage of user credentials upon installation or upgrade of software.
During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the…
-
Medium 6.3
A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at re…
-
Medium 5.5
Grafana information disclosure
An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted dat…
-
Medium 4.3
Credentials stored in plain text by Jenkins Copr Plugin
Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Unscored —CVE-2020-5723 Public exploit
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an att…
-
Low 3.3
Passwords stored in plain text by Jenkins Artifactory Plugin
Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
-
High 7.5
django-nopassword stores secrets in cleartext
django-nopassword before 5.0.0 stores cleartext secrets in the database.
-
Unscored —
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Con…
-
Low 3.3
Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text
Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file system.
-
Medium 4.6
A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are st…
-
Unscored —
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower,…
-
High 8.4
A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames a…
-
Medium 4.1
Katello cleartext password storage issue
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials …
-
Medium 5.3
Magento 2 Community Edition Weak Cryptography
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
-
High 7.8
Jenkins Delphix Plugin vulnerable to Cleartext credential storage
Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins SOASTA CloudTest Plugin stores API token in plain text
Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins View26 Test-Reporting Plugin stores access token in plain text
Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Low 3.3
Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin
Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins Fortify on Demand Plugin stores credentials in plain text
Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Sofy.AI Plugin stores API token in plain text
Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
High 8.8
Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin
Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
High 8.8
Jenkins iceScrum Plugin stores credentials in Cleartext
Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
-
High 8.8
Jenkins NeoLoad Plugin stores credentials in cleartext
Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.5
Centreon Sensitive Data Exposure
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
-
Low 3.3
DingTalk Plugin stores credentials in plain text
Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 5.5
Jenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
High 7.2
Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a…
-
High 7.5
Sensitive data written to disk unencrypted in Spark
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, us…
-
Medium 4.3
Jenkins Caliper CI Plugin stores credentials in plain text
Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Port Allocator Plugin stores credentials in plain text
Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Gogs Plugin stored credentials in plain text
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Unscored —
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode,…
-
Unscored —
An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored…
-
Unscored —
Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, …
-
Unscored —
Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Sys…
-
Unscored —
An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Rel…