616
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 255 Credentials Management Errors 2315
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Avoid storing passwords in easily accessible locations.
Phase: Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
A programmer might attempt to remedy the password management problem by obscuring
the password with an encoding function, such as base 64 encoding, but this effort does not
adequately protect the password because the encoding can be detected and decoded easily.
Effectiveness = None
Demonstrative Examples
Example 1:
The following code reads a password from a properties file and uses the password to connect to a
database.
Example Language: Java (Bad)
...
Properties prop = new Properties();
prop.load(new FileInputStream("config.properties"));
String password = prop.getProperty("password");
CWE Version 4.14
CWE-256: Plaintext Storage of a Password
CWE-256: Plaintext Storage of a Password