1226
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
ChildOf 1390 Weak Authentication 2267
ParentOf 256 Plaintext Storage of a Password 615
ParentOf 257 Storing Passwords in a Recoverable Format 618
ParentOf 260 Password in Configuration File 629
ParentOf 261 Weak Encoding for Password 631
ParentOf 523 Unprotected Transport of Credentials 1230
ParentOf 549 Missing Password Field Masking 1262
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 287 Improper Authentication 692
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
An attacker could gain access to user accounts and
access sensitive data used by the user accounts.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Use an appropriate security mechanism to protect the credentials.
Phase: Architecture and Design
Make appropriate use of cryptography to protect the credentials.
Phase: Implementation
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
Demonstrative Examples
CWE Version 4.14
CWE-522: Insufficiently Protected Credentials
CWE-522: Insufficiently Protected Credentials