cve.bz

CWE-257: Storing Passwords in a Recoverable Format, page 2

Filter

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

What the weakness is: CWE-257 at MITRE. All weaknesses

Related attack patterns (CAPEC): 1
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-257, as MITRE names them. Credits.

Ask an AI about CWE-257

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-257: Storing Passwords in a Recoverable Format and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/257.html and https://cve.bz/cve/cwe/257?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2023-23382EPSS 2.7%

    Azure Machine Learning Compute Instance Information Disclosure Vulnerability

  2. 9.8CVE-2022-32519EPSS 0.5%

    A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert (Versions prio…

  3. 7.8CVE-2023-21726EPSS 0.5%

    Windows Credential Manager User Interface Elevation of Privilege Vulnerability

  4. 5.2CVE-2022-46142EPSS 0.3%

    Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords.

  5. 7.8CVE-2022-22251EPSS 0.2%

    On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their pe…

  6. 8.4CVE-2022-34838EPSS 0.2%

    Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data …

  7. 6.1CVE-2022-34837EPSS 0.1%

    Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network clients that may monitor various activities of the Zenon.

  8. 7.5CVE-2021-35050EPSS 1.0%

    User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulner…

  9. 7.5CVE-2021-27485EPSS 1.2%

    ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser.

  10. 6.7CVE-2020-8296EPSS 0.5%

    Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.

  11. 6.8CVE-2021-0220EPSS 1.2%

    The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or…

  12. 4.6CVE-2019-18256EPSS 0.4%

    BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical access to the CardioMessenger can use these credentials for network authentication…

  13. 6.1CVE-2019-19096EPSS 0.3%

    The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality.

  14. 7.2CVE-2019-3736EPSS 0.7%

    Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support tool to decrypt enc…

  15. 6.5CVE-2019-1010241EPSS 1.4%

    Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVari…

  16. 5.5CVE-2019-6567EPSS 0.3%

    A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (inc…

  17. 6.5CVE-2019-5615EPSS 0.8%

    Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credent…

  18. 4.9CVE-2018-5446EPSS 0.4%

    Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.

  19. 7.8CVE-2017-9942EPSS 0.3%

    A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass integrated client to potentially obtain credentials from the s…