764
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-265]Frank Kim. "Top 25 Series - Rank 10 - Missing Encryption of Sensitive Data". 2010
February 6. SANS Software Security Institute. < https://www.sans.org/blog/top-25-series-rank-10-
missing-encryption-of-sensitive-data/ >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
CWE-312: Cleartext Storage of Sensitive Information
Weakness ID : 312
Structure : Simple
Abstraction : Base
Description
The product stores sensitive information in cleartext within a resource that might be accessible to
another control sphere.
Extended Description
Because the information is stored in cleartext (i.e., unencrypted), attackers could potentially read
it. Even if the information is encoded in a way that is not human-readable, certain techniques could
determine which encoding is being used, then decode the information.
When organizations adopt cloud services, it can be easier for attackers to access the data from
anywhere on the Internet.
In some systems/environments such as cloud, the use of "double encryption" (at both the software
and hardware layer) might be required, and the developer might be solely responsible for both
layers, instead of shared responsibility with the administrator of the broader system/environment.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 922 Insecure Storage of Sensitive Information 1825
ChildOf 311 Missing Encryption of Sensitive Data 757
ParentOf 313 Cleartext Storage in a File or on Disk 770
ParentOf 314 Cleartext Storage in the Registry 772
ParentOf 315 Cleartext Storage of Sensitive Information in a Cookie 774
ParentOf 316 Cleartext Storage of Sensitive Information in Memory 775
ParentOf 317 Cleartext Storage of Sensitive Information in GUI 777
ParentOf 318 Cleartext Storage of Sensitive Information in Executable 778
CWE Version 4.14
CWE-312: Cleartext Storage of Sensitive Information
CWE-312: Cleartext Storage of Sensitive Information