777
Terminology
Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption.
However, within cryptography, these have more precise meanings. Plaintext is the information
just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is
any information that is unencrypted, although it might be in an encoded form that is not easily
human-readable (such as base64 encoding).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Plaintext Storage in Memory
Software Fault Patterns SFP23 Exposed Data
CWE-317: Cleartext Storage of Sensitive Information in GUI
Weakness ID : 317
Structure : Simple
Abstraction : Variant
Description
The product stores sensitive information in cleartext within the GUI.
Extended Description
An attacker can often obtain data from a GUI, even if hidden, by using an API to directly access
GUI objects such as windows and menus. Even if the information is encoded in a way that is not
human-readable, certain techniques could determine which encoding is being used, then decode
the information.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 312 Cleartext Storage of Sensitive Information 764
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Windows (Prevalence = Sometimes)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Read Application Data
Observed Examples
Reference Description
CVE-2002-1848 Unencrypted passwords stored in GUI dialog may allow local users to access
the passwords.
CWE Version 4.14
CWE-318: Cleartext Storage of Sensitive Information in Executable
CWE-318: Cleartext Storage of Sensitive Information in Executable