1250
Reference Description
CVE-2018-1999036SSH password for private key stored in build log
https://www.cve.org/CVERecord?id=CVE-2018-1999036
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 815 OWASP Top Ten 2010 Category A6 - Security
Misconfiguration
809 2358
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Notes
Maintenance
Depending on usage, this could be a weakness or a category. Further study of all its children
is needed, and the entire sub-tree may need to be clarified. The current organization is based
primarily on the exposure of sensitive information as a consequence, instead of as a primary
weakness.
Maintenance
There is a close relationship with CWE-552, which is more focused on weaknesses. As a result,
it may be more appropriate to convert CWE-538 to a category.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
95 WSDL Scanning
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-539: Use of Persistent Cookies Containing Sensitive Information
Weakness ID : 539
Structure : Simple
Abstraction : Variant
Description
The web application uses persistent cookies, but the cookies contain sensitive information.
Extended Description
Cookies are small bits of data that are sent by the web application but stored locally in the browser.
This lets the application use the cookie to pass information between pages and store variable
information. The web application controls what information is stored in a cookie and how it is
used. Typical types of information stored in cookies are session identifiers, personalization and
customization information, and in rare cases even usernames to enable automated logins. There
are two different types of cookies: session cookies and persistent cookies. Session cookies just
live in the browser's memory and are not stored anywhere, but persistent cookies are stored on
CWE Version 4.14
CWE-540: Inclusion of Sensitive Information in Source Code
CWE-540: Inclusion of Sensitive Information in Source Code