cve.bz

CWE-522: Insufficiently Protected Credentials, page 21

Filter

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

What the weakness is: CWE-522 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 13
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-474 Signature Spoofing by Key Theft Likelihood: Medium · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-551 Modify Existing Service
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-522, as MITRE names them. Credits.

Ask an AI about CWE-522

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-522: Insufficiently Protected Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/522.html and https://cve.bz/cve/cwe/522?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2021-1731EPSS 0.9%

    PFX Encryption Security Feature Bypass Vulnerability

  2. 7.5CVE-2021-3252EPSS 2.6%

    KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have …

  3. 6.5CVE-2021-20445EPSS 1.3%

    IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621.

  4. 8.8CVE-2020-9306EPSS 1.2%

    Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.

  5. 5.3CVE-2021-20410EPSS 0.7%

    IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.

  6. 7.5CVE-2021-27187EPSS 2.0%

    The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked.

  7. 5.5CVE-2020-14391EPSS 0.3%

    A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This f…

  8. 7.5CVE-2020-10554EPSS 0.8%

    An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, which can be easily reverted. For example, the password AAAAAAAA is stored in the database as MMMMMMMM.

  9. 7.5CVE-2020-29005EPSS 0.7%

    The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure.

  10. 6.5CVE-2020-27258EPSS 0.6%

    In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows unauthenticated atta…

  11. 5.7CVE-2020-27270EPSS 0.3%

    SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate measures to protect encryption keys in transit which allows unauthenticated physic…

  12. 6.8CVE-2021-0220EPSS 1.2%

    The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or…

  13. 5.0CVE-2021-0212EPSS 0.3%

    An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administrator credentials stored in plaintext thereby elevating their privileges over the …

  14. 4.8CVE-2021-22132EPSS 1.2%

    Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks inde…

  15. 5.5CVE-2021-1126EPSS 0.3%

    A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view credentials for a configured proxy server. The vulnerability is due to clear-text st…

  16. 4.4CVE-2020-4602EPSS 0.3%

    IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184836.

  17. 5.5CVE-2021-21614EPSS 0.3%

    Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

  18. 5.5CVE-2021-21612EPSS 0.3%

    Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

  19. 5.5CVE-2020-28390EPSS 0.5%

    A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to…

  20. 4.4CVE-2020-4913EPSS 0.3%

    IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288.

  21. 7.2CVE-2020-2499EPSS 1.4%

    A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200…

  22. 9.8CVE-2020-29583KEVExploitEPSS 90%

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the…

  23. 7.0CVE-2020-24680EPSS 0.3%

    In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database.

  24. 7.1CVE-2020-27781EPSS 0.3%

    User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including exist…

  25. 9.8CVE-2019-14480EPSS 1.1%

    AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges.

  26. 5.5CVE-2019-14477EPSS 0.3%

    AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted.

  27. 7.5CVE-2020-25235EPSS 1.4%

    A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The password used for authentication for the LOGO! Website and the LOGO! Access Tool is sent in a recoverable format. An attacker with access …

  28. 9.8CVE-2020-25175EPSS 1.1%

    GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.

  29. 7.8CVE-2020-28219EPSS 0.3%

    A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original…

  30. 5.9CVE-2020-29380EPSS 0.5%

    An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. TELNET is offered by default but SSH is not always available. An attacker ca…

  31. 9.8CVE-2020-29054EPSS 1.4%

    An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD…

  32. 6.5CVE-2020-28330EPSS 1.2%

    Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (retrieved by exploiting CVE-2020-28329) can issue an authenticated query to displ…

  33. 7.5CVE-2020-24227EPSS 1.4%

    Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to UserProfiles.sol to extract the email and password.

  34. 4.9CVE-2020-26079EPSS 1.0%

    A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user cre…

  35. 5.5CVE-2020-27557EPSS 0.3%

    Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming username and password via SQLite files containing plain text credentials.

  36. 7.5CVE-2020-27554EPSS 0.7%

    Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensitive information transmitted between the mobile app and the camera device.

  37. 9.8CVE-2020-26508EPSS 1.1%

    The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though these are intentionally inaccessible in the UI.

  38. 8.1CVE-2020-8259EPSS 0.7%

    Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.

  39. 4.4CVE-2020-8152EPSS 0.3%

    Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.

  40. 7.8CVE-2020-12333EPSS 0.3%

    Insufficiently protected credentials in the Intel(R) QAT for Linux before version 1.7.l.4.10.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  41. 5.5CVE-2020-12316EPSS 0.3%

    Insufficiently protected credentials in the Intel(R) EMA before version 1.3.3 may allow an authorized user to potentially enable information disclosure via local access.

  42. 4.6CVE-2020-12309EPSS 0.3%

    Insufficiently protected credentialsin subsystem in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.

  43. 5.5CVE-2020-4568EPSS 0.7%

    IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157.

  44. 7.5CVE-2020-27688EPSS 1.9%

    RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe execut…

  45. 6.5CVE-2020-2319EPSS 1.0%

    Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

  46. 6.5CVE-2020-2318EPSS 1.1%

    Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins …

  47. 5.5CVE-2020-2314EPSS 0.3%

    Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

  48. 7.5CVE-2020-8183EPSS 1.9%

    A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.

  49. 7.5CVE-2020-27888EPSS 1.0%

    An issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi Controller 6.0.28 devices. Cached credentials are not erased from an access point returning wirelessly from a disconnected state. This may provi…

  50. 6.5CVE-2020-7196EPSS 0.9%

    The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, the…