cve.bz

CWE-312: Cleartext Storage of Sensitive Information, page 10

Filter

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

What the weakness is: CWE-312 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 1
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-312, as MITRE names them. Credits.

Ask an AI about CWE-312

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-312: Cleartext Storage of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/312.html and https://cve.bz/cve/cwe/312?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2023-20914EPSS 0.06%

    In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to read SMS messages due to a permissions bypass. This could lead to local information disclosure with U…

  2. 7.5CVE-2023-31408EPSS 0.4%

    Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to potentially steal user credentials that are stored in the us…

  3. 6.5CVE-2023-24586EPSS 0.5%

    Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to obtain an APN credential for the product.

  4. 6.5CVE-2023-30853EPSS 0.3%

    Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the co…

  5. 5.5CVE-2023-29471EPSS 0.2%

    Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

  6. 7.5CVE-2023-2335EPSS 0.3%

    Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0.

  7. 7.5CVE-2023-29480EPSS 0.4%

    Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

  8. 7.5CVE-2023-31043EPSS 0.4%

    EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_c…

  9. 4.9CVE-2023-22894KEVEPSS 4.1%

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from AP…

  10. 4.9CVE-2023-22949EPSS 0.4%

    An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and passwo…

  11. 6.5CVE-2023-30531EPSS 0.4%

    Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.

  12. 4.3CVE-2023-30530EPSS 0.3%

    Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file sys…

  13. 6.5CVE-2023-30528EPSS 0.4%

    Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.

  14. 4.3CVE-2023-30527EPSS 0.3%

    Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

  15. 4.3CVE-2023-30523EPSS 0.3%

    Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission …

  16. 4.9CVE-2023-0005EPSS 0.3%

    A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.

  17. 7.8CVE-2023-26593EPSS 0.1%

    CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file sto…

  18. 6.5CVE-2023-0614EPSS 0.6%

    The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.

  19. 7.5CVE-2023-1683EPSS 0.5%

    A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack ma…

  20. 5.5CVE-2023-25263EPSS 0.2%

    In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not dif…

  21. 6.5CVE-2023-20059EPSS 0.4%

    A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged…

  22. 4.9CVE-2023-25596EPSS 0.3%

    A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which coul…

  23. 3.1CVE-2023-23776EPSS 0.2%

    An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6.4.0 through 6.4.10 may allow a remote authenticated attacker to read the client…

  24. 5.5CVE-2022-48310EPSS 0.1%

    An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.

  25. 7.5CVE-2023-26760EPSS 0.5%

    Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint. This vulnerability allows attackers to access cleartext credentials needed to authenticate to the AS400 system.

  26. 5.5CVE-2022-34910EPSS 0.1%

    An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password is stored in cleartext. Therefore, an attacker can retrieve the passwords of othe…

  27. 6.5CVE-2022-31405EPSS 0.6%

    MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext.

  28. 7.5CVE-2022-34351EPSS 0.4%

    IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data from other domains. IBM X-Force ID: 230402.

  29. 7.5CVE-2022-41734EPSS 0.5%

    IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against th…

  30. 5.5CVE-2023-24964EPSS 0.1%

    IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files. IBM X-Force ID: 246463.

  31. 5.5CVE-2022-45154EPSS 0.2%

    A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to ga…

  32. 9.8CVE-2022-3089EPSS 0.2%

    Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials coul…

  33. 7.1CVE-2022-34388EPSS 0.2%

    Dell SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability. A local malicious user with low privileges could exploit this vulnerabil…

  34. 4.2CVE-2022-24410EPSS 0.2%

    Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the system and knowledge of the system configuration could potentially exploit this vulnerability to read system informatio…

  35. 7.1CVE-2023-0690EPSS 0.4%

    HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been…

  36. 8.8CVE-2022-43757EPSS 0.6%

    A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prio…

  37. 6.5CVE-2023-23944EPSS 0.5%

    Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with …

  38. 5.5CVE-2022-45098EPSS 0.1%

    Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component. An authenticated local attacker could potentially exploit this vulnerability, leading to information disclosure.

  39. 6.5CVE-2022-45897EPSS 0.4%

    On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials associated with those settings.

  40. 6.5CVE-2023-22332EPSS 0.7%

    Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All ve…

  41. 7.5CVE-2022-48073EPSS 0.5%

    Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.

  42. 7.5CVE-2022-48071EPSS 0.4%

    Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext.

  43. 5.5CVE-2023-24454EPSS 0.2%

    Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file sy…

  44. 6.5CVE-2023-24450EPSS 0.6%

    Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

  45. 5.5CVE-2023-24442EPSS 0.2%

    Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be vi…

  46. 5.5CVE-2023-24439EPSS 0.2%

    Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file …

  47. 5.5CVE-2023-24055EPSS 3.8%

    KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password databa…

  48. 7.5CVE-2022-38112EPSS 0.4%

    In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.

  49. 6.5CVE-2022-45439EPSS 0.2%

    A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. An unauthenticated attacker could use the credentials to access the WLAN service if the configurati…

  50. 5.5CVE-2022-42284EPSS 0.1%

    NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure.