779
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Observed Examples
Reference Description
CVE-2005-1794 Product stores RSA private key in a DLL and uses it to sign a certificate,
allowing spoofing of servers and Adversary-in-the-Middle (AITM) attacks.
https://www.cve.org/CVERecord?id=CVE-2005-1794
CVE-2001-1527 administration passwords in cleartext in executable
https://www.cve.org/CVERecord?id=CVE-2001-1527
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Terminology
Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption.
However, within cryptography, these have more precise meanings. Plaintext is the information
just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is
any information that is unencrypted, although it might be in an encoded form that is not easily
human-readable (such as base64 encoding).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Plaintext Storage in Executable
Related Attack Patterns
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
65 Sniff Application Code
CWE-319: Cleartext Transmission of Sensitive Information
Weakness ID : 319
Structure : Simple
Abstraction : Base
Description
The product transmits sensitive or security-critical data in cleartext in a communication channel that
can be sniffed by unauthorized actors.
Extended Description
Many communication channels can be "sniffed" (monitored) by adversaries during data
transmission. For example, in networking, packets can traverse many intermediary nodes from the
source to the destination, whether across the internet, an internal network, the cloud, etc. Some
actors might have privileged access to a network interface or any link along the channel, such as
CWE Version 4.14
CWE-319: Cleartext Transmission of Sensitive Information
CWE-319: Cleartext Transmission of Sensitive Information