772
Username and password information should not be included in a configuration file or a properties
file in cleartext as this will allow anyone who can read the file access to the resource. If possible,
encrypt this information.
Observed Examples
Reference Description
CVE-2001-1481 Cleartext credentials in world-readable file.
https://www.cve.org/CVERecord?id=CVE-2001-1481
CVE-2005-1828 Password in cleartext in config file.
https://www.cve.org/CVERecord?id=CVE-2005-1828
CVE-2005-2209 Password in cleartext in config file.
https://www.cve.org/CVERecord?id=CVE-2005-2209
CVE-2002-1696 Decrypted copy of a message written to disk given a combination of options
and when user replies to an encrypted message.
https://www.cve.org/CVERecord?id=CVE-2002-1696
CVE-2004-2397 Cleartext storage of private key and passphrase in log file when user imports
the key.
https://www.cve.org/CVERecord?id=CVE-2004-2397
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Terminology
Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption.
However, within cryptography, these have more precise meanings. Plaintext is the information
just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is
any information that is unencrypted, although it might be in an encoded form that is not easily
human-readable (such as base64 encoding).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Plaintext Storage in File or on Disk
Software Fault Patterns SFP23 Exposed Data
CWE-314: Cleartext Storage in the Registry
Weakness ID : 314
Structure : Simple
Abstraction : Variant
Description
The product stores sensitive information in cleartext in the registry.
Extended Description
CWE Version 4.14
CWE-314: Cleartext Storage in the Registry
CWE-314: Cleartext Storage in the Registry