770
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-172]Chris Wysopal. "Mobile App Top 10 List". 2010 December 3. < https://
www.veracode.com/blog/2010/12/mobile-app-top-10-list >.2023-04-07.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
[REF-1295]WizCase. "Over 80 US Municipalities' Sensitive Information, Including Resident's
Personal Data, Left Vulnerable in Massive Data Breach". 2021 July 0. < https://www.wizcase.com/
blog/us-municipality-breach-report/ >.
[REF-1296]Jonathan Greig. "1,000 GB of local government data exposed by Massachusetts
software company". 2021 July 2. < https://www.zdnet.com/article/1000-gb-of-local-governmentdata-
exposed-by-massachusetts-software-company/ >.
[REF-1297]Amazon. "AWS Foundational Security Best Practices controls". 2022. < https://
docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html
>.2023-04-07.
[REF-1299]Microsoft. "Azure encryption overview". 2022 August 8. < https://learn.microsoft.com/
en-us/azure/security/fundamentals/encryption-overview >.2022-10-11.
[REF-1301]Google Cloud. "Default encryption at rest". 2022 October 1. < https://cloud.google.com/
docs/security/encryption/default-encryption >.2022-10-11.
[REF-1307]Center for Internet Security. "CIS Microsoft Azure Foundations Benchmark version
1.5.0". 2022 August 6. < https://www.cisecurity.org/benchmark/azure >.2023-01-19.
[REF-1310]Microsoft. "Enable infrastructure encryption for double encryption of data". 2022 July
4. < https://learn.microsoft.com/en-us/azure/storage/common/infrastructure-encryption-enable
>.2023-01-24.
CWE-313: Cleartext Storage in a File or on Disk
Weakness ID : 313
Structure : Simple
Abstraction : Variant
Description
The product stores sensitive information in cleartext in a file, or on disk.
Extended Description
The sensitive information could be read by attackers with access to the file, or with physical or
administrator access to the raw disk. Even if the information is encoded in a way that is not humanreadable,
certain techniques could determine which encoding is being used, then decode the
information.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-313: Cleartext Storage in a File or on Disk
CWE-313: Cleartext Storage in a File or on Disk