14
Username and password information should not be included in a configuration file or a properties
file in plaintext as this will allow anyone who can read the file access to the resource. If possible,
encrypt this information.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 2 7PK - Environment 700 2308
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms ASP.NET Misconfiguration: Password
in Configuration File
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-103]Microsoft Corporation. "How To: Encrypt Configuration Sections in ASP.NET 2.0 Using
DPAPI". < https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff647398(v=pandp.10)?
redirectedfrom=MSDN >.2023-04-07.
[REF-104]Microsoft Corporation. "How To: Encrypt Configuration Sections in ASP.NET 2.0 Using
RSA". < https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff650304(v=pandp.10)?
redirectedfrom=MSDN >.2023-04-07.
[REF-105]Microsoft Corporation. ".NET Framework Developer's Guide - Securing Connection
Strings". < http://msdn.microsoft.com/en-us/library/89211k9b(VS.80).aspx >.
CWE-14: Compiler Removal of Code to Clear Buffers
Weakness ID : 14
Structure : Simple
Abstraction : Variant
Description
Sensitive memory is cleared according to the source code, but compiler optimizations leave the
memory untouched when it is not read from again, aka "dead store removal."
Extended Description
This compiler optimization error occurs when:
1. Secret data are stored in memory.
2. The secret data are scrubbed from memory by overwriting its contents.
CWE Version 4.14
CWE-14: Compiler Removal of Code to Clear Buffers
CWE-14: Compiler Removal of Code to Clear Buffers