cve.bz

CWE-522: Insufficiently Protected Credentials, page 23

Filter

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

What the weakness is: CWE-522 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 13
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-474 Signature Spoofing by Key Theft Likelihood: Medium · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-551 Modify Existing Service
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-522, as MITRE names them. Credits.

Ask an AI about CWE-522

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-522: Insufficiently Protected Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/522.html and https://cve.bz/cve/cwe/522?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.6CVE-2019-18256EPSS 0.4%

    BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical access to the CardioMessenger can use these credentials for network authentication…

  2. 5.5CVE-2020-10727EPSS 0.7%

    A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers`…

  3. 8.1CVE-2020-14930ExploitEPSS 3.4%

    An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only…

  4. 7.5CVE-2018-21248EPSS 1.2%

    An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.

  5. 7.5CVE-2020-0540EPSS 2.0%

    Insufficiently protected credentials in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable information disclosure via network access.

  6. 7.5CVE-2020-10752EPSS 1.1%

    A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error t…

  7. 6.5CVE-2020-10755EPSS 1.2%

    An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16…

  8. 4.4CVE-2020-6239EPSS 0.3%

    Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure.

  9. 8.1CVE-2020-11681EPSS 1.1%

    Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials.

  10. 5.3CVE-2018-21239EPSS 0.8%

    An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action.

  11. 5.3CVE-2018-21237EPSS 0.8%

    An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.

  12. 5.5CVE-2020-7030ExploitEPSS 1.0%

    A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, …

  13. 6.5CVE-2020-2198EPSS 0.8%

    Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure.

  14. 7.5CVE-2014-9702EPSS 1.3%

    system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (username and password) via any request, such as a password reset request.

  15. 7.8CVE-2014-8938EPSS 0.3%

    Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.

  16. 6.5CVE-2019-13023EPSS 0.8%

    An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RADIUS secrets, WPA passwords, and SNMP strings from 'non administrative' users using HTML 'password field' obfuscation. B…

  17. 5.5CVE-2014-1423EPSS 0.8%

    signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker cou…

  18. 7.5CVE-2020-10972EPSS 1.8%

    An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variabl…

  19. 9.8CVE-2019-18868EPSS 0.8%

    Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak.

  20. 4.3CVE-2020-2182EPSS 0.9%

    Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.

  21. 6.5CVE-2020-2181EPSS 1.1%

    Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

  22. 7.5CVE-2019-19218EPSS 1.0%

    BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.

  23. 5.3CVE-2020-11821EPSS 1.1%

    In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them.

  24. 7.5CVE-2020-12273EPSS 0.8%

    In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.

  25. 5.5CVE-2019-4668EPSS 0.3%

    IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250.

  26. 5.5CVE-2019-19105EPSS 0.3%

    The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's crede…

  27. 7.8CVE-2017-18777EPSS 0.3%

    Certain NETGEAR devices are affected by administrative password disclosure. This affects D6220 before V1.0.0.28, D6400 before V1.0.0.60, D8500 before V1.0.3.29, DGN2200v4 before 1.0.0.82, DGN2200Bv4 before 1.0.0.82, R6300v2 before 1.0.4.8,…

  28. 7.5CVE-2020-11008EPSS 3.9%

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the d…

  29. 7.8CVE-2017-18845EPSS 0.3%

    Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38 and R6800 before 1.1.0.38.

  30. 7.8CVE-2017-18844EPSS 0.4%

    Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before 1.0.1.50.

  31. 7.8CVE-2017-18843EPSS 0.3%

    Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before 1.0.1.50.

  32. 8.8CVE-2020-9523EPSS 0.9%

    Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to …

  33. 5.5CVE-2020-5721EPSS 0.4%

    MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Passwo…

  34. 7.5CVE-2020-5260EPSS 15%

    Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credenti…

  35. 9.8CVE-2020-6195EPSS 0.6%

    SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is k…

  36. 7.5CVE-2020-11694EPSS 1.9%

    In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3.

  37. 6.5CVE-2020-5406EPSS 1.0%

    VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, inclu…

  38. 4.9CVE-2020-5263EPSS 0.9%

    auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which m…

  39. 7.5CVE-2020-11557EPSS 0.7%

    An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password values in cleartext within each request's cookie value.

  40. 7.5CVE-2020-11555EPSS 1.4%

    An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive credential information from backup files.

  41. 4.4CVE-2020-1978EPSS 0.3%

    TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent t…

  42. 7.2CVE-2020-11629EPSS 0.6%

    An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certifi…

  43. 7.8CVE-2020-11560ExploitEPSS 1.0%

    NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

  44. 6.5CVE-2017-18695EPSS 0.3%

    An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Attackers (who control a certain subdomain) can discover a user's credentials, during an email account login, via an EAS autodiscover …

  45. 7.5CVE-2016-11029EPSS 0.4%

    An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 (December 20…

  46. 6.1CVE-2019-19096EPSS 0.3%

    The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality.

  47. 7.5CVE-2019-3942EPSS 1.4%

    Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password.

  48. 7.5CVE-2020-11449EPSS 1.2%

    An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsettings.conf.

  49. 7.5CVE-2020-2165EPSS 1.1%

    Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

  50. 6.5CVE-2020-2164EPSS 0.8%

    Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.