775
Observed Examples
Reference Description
CVE-2002-1800 Admin password in cleartext in a cookie.
https://www.cve.org/CVERecord?id=CVE-2002-1800
CVE-2001-1537 Default configuration has cleartext usernames/passwords in cookie.
https://www.cve.org/CVERecord?id=CVE-2001-1537
CVE-2001-1536 Usernames/passwords in cleartext in cookies.
https://www.cve.org/CVERecord?id=CVE-2001-1536
CVE-2005-2160 Authentication information stored in cleartext in a cookie.
https://www.cve.org/CVERecord?id=CVE-2005-2160
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Terminology
Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption.
However, within cryptography, these have more precise meanings. Plaintext is the information
just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is
any information that is unencrypted, although it might be in an encoded form that is not easily
human-readable (such as base64 encoding).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Plaintext Storage in Cookie
Software Fault Patterns SFP23 Exposed Data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
31 Accessing/Intercepting/Modifying HTTP Cookies
37 Retrieve Embedded Sensitive Data
39 Manipulating Opaque Client-based Data Tokens
74 Manipulating State
CWE-316: Cleartext Storage of Sensitive Information in Memory
Weakness ID : 316
Structure : Simple
Abstraction : Variant
Description
The product stores sensitive information in cleartext in memory.
Extended Description
The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the
product crashes, or if the programmer does not properly clear the memory before freeing it.
CWE Version 4.14
CWE-316: Cleartext Storage of Sensitive Information in Memory
CWE-316: Cleartext Storage of Sensitive Information in Memory