769
Reference Description
CVE-2002-1696 Decrypted copy of a message written to disk given a combination of options
and when user replies to an encrypted message.
https://www.cve.org/CVERecord?id=CVE-2002-1696
CVE-2004-2397 Plaintext storage of private key and passphrase in log file when user imports
the key.
https://www.cve.org/CVERecord?id=CVE-2004-2397
CVE-2002-1800 Admin password in plaintext in a cookie.
https://www.cve.org/CVERecord?id=CVE-2002-1800
CVE-2001-1537 Default configuration has cleartext usernames/passwords in cookie.
https://www.cve.org/CVERecord?id=CVE-2001-1537
CVE-2001-1536 Usernames/passwords in cleartext in cookies.
https://www.cve.org/CVERecord?id=CVE-2001-1536
CVE-2005-2160 Authentication information stored in cleartext in a cookie.
https://www.cve.org/CVERecord?id=CVE-2005-2160
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 816 OWASP Top Ten 2010 Category A7 - Insecure
Cryptographic Storage
809 2359
MemberOf 884 CWE Cross-section 884 2567
MemberOf 934 OWASP Top Ten 2013 Category A6 - Sensitive Data
Exposure
928 2391
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1029 OWASP Top Ten 2017 Category A3 - Sensitive Data
Exposure
1026 2436
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Terminology
Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption.
However, within cryptography, these have more precise meanings. Plaintext is the information
just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is
any information that is unencrypted, although it might be in an encoded form that is not easily
human-readable (such as base64 encoding).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Plaintext Storage of Sensitive
Information
Software Fault Patterns SFP23 Exposed Data
ISA/IEC 62443 Part 4-2 Req CR 4.1 a)
ISA/IEC 62443 Part 3-3 Req SR 4.1
Related Attack Patterns
CWE Version 4.14
CWE-313: Cleartext Storage in a File or on Disk
CWE-313: Cleartext Storage in a File or on Disk