763
Nature Type ID Name Page
MemberOf 1152 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 49. Miscellaneous (MSC)
1133 2453
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Relationship
There is an overlapping relationship between insecure storage of sensitive information
(CWE-922) and missing encryption of sensitive information (CWE-311). Encryption is often used
to prevent an attacker from reading the sensitive data. However, encryption does not prevent the
attacker from erasing or overwriting the data.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to encrypt data
OWASP Top Ten 2007 A8 CWE More Specific Insecure Cryptographic Storage
OWASP Top Ten 2007 A9 CWE More Specific Insecure Communications
OWASP Top Ten 2004 A8 CWE More Specific Insecure Storage
WASC 4 Insufficient Transport Layer Protection
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC00-J Use SSLSocket rather than Socket for
secure data exchange
Software Fault Patterns SFP23 Exposed Data
ISA/IEC 62443 Part 3-3 Req SR 4.1
ISA/IEC 62443 Part 3-3 Req SR 4.3
ISA/IEC 62443 Part 4-2 Req CR 4.1
ISA/IEC 62443 Part 4-2 Req CR 7.3
ISA/IEC 62443 Part 4-2 Req CR 1.5
Related Attack Patterns
CAPEC-ID Attack Pattern Name
31 Accessing/Intercepting/Modifying HTTP Cookies
37 Retrieve Embedded Sensitive Data
65 Sniff Application Code
157 Sniffing Attacks
158 Sniffing Network Traffic
204 Lifting Sensitive Data Embedded in Cache
383 Harvesting Information via API Event Monitoring
384 Application API Message Manipulation via Man-in-the-Middle
385 Transaction or Event Tampering via Application API Manipulation
386 Application API Navigation Remapping
387 Navigation Remapping To Propagate Malicious Content
388 Application API Button Hijacking
477 Signature Spoofing by Mixing Signed and Unsigned Content
609 Cellular Traffic Intercept
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE Version 4.14
CWE-312: Cleartext Storage of Sensitive Information
CWE-312: Cleartext Storage of Sensitive Information