1234
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1016 Limit Exposure 2431
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 199 Information Management Errors 2312
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Demonstrative Examples
Example 1:
In the example below, the password for a keystore file is read from a system property.
Example Language: Java (Bad)
String keystorePass = System.getProperty("javax.net.ssl.keyStorePassword");
if (keystorePass == null) {
System.err.println("ERROR: Keystore password not specified.");
System.exit(-1);
}
...
If the property is defined on the command line when the program is invoked (using the -D... syntax),
the password may be displayed in the OS process list.
Observed Examples
Reference Description
CVE-2005-1387 password passed on command line
https://www.cve.org/CVERecord?id=CVE-2005-1387
CVE-2005-2291 password passed on command line
https://www.cve.org/CVERecord?id=CVE-2005-2291
CVE-2001-1565 username/password on command line allows local users to view via "ps" or
other process listing programs
https://www.cve.org/CVERecord?id=CVE-2001-1565
CVE-2004-1948 Username/password on command line allows local users to view via "ps" or
other process listing programs.
https://www.cve.org/CVERecord?id=CVE-2004-1948
CVE-1999-1270 PGP passphrase provided as command line argument.
https://www.cve.org/CVERecord?id=CVE-1999-1270
CWE Version 4.14
CWE-215: Insertion of Sensitive Information Into Debugging Code
CWE-215: Insertion of Sensitive Information Into Debugging Code