Skip to content
OpenAdvisories

Weakness (CWE)

CWE-312: Cleartext Storage of Sensitive Information

Base Draft

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

How to prevent it (2 mitigations)

  1. Implementation, System Configuration, Operation

    When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]

  2. Implementation, System Configuration, Operation

    In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Source: MITRE CWE-312

All Critical High Medium Low Exploited only Public exploit

571 results · Feed

  • Unscored —
    CVE-2019-6549

    An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Rel…

    ICS-CERT PR100088 Modbus gateway
  • Unscored —
    CVE-2018-19009

    Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system cont…

    Pilz Pilz PNOZmulti Configurator
  • Low 3.8
    CVE-2018-10871

    389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default…

    [UNKNOWN] 389-ds-base 389-ds-base 389-ds-base Debian Ubuntu
  • Medium 6.5
    CVE-2017-2672

    A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with acces…

    [UNKNOWN] foreman
  • Unscored —
    CVE-2017-9654

    The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear t…

    Philips DoseWise Portal
  • Unscored —
    CVE-2016-8366 Public exploit

    Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincide…

    Phoenix Contact Phoenix Contact ILC PLCs ICS / OT
  • High 7.5
    CVE-2018-8947 Public exploit EPSS 11%

    Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0

    rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

    rap2hpoutre/laravel-log-viewer Packagist
  • Unscored —
    CVE-2017-9663

    An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS…

    iOS
  • Unscored —
    CVE-2017-3214

    The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary.

    Milwaukee Tool ONE-KEY
  • Medium —
    CVE-2013-5676 Public exploit

    Jenkins SonarQube Plugin Stores Passwords in Cleartext

    The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

    org.jenkins-ci.plugins:sonar Maven
  • Medium 5.7
    CVE-2011-4723 Exploited

    The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive info…

    KEV Sep 8, 2022