CWE-312 敏感数据的明文存储

Cleartext Storage of Sensitive Information

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown


The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.


Because the information is stored in cleartext, attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.


  • cwe_Nature: ChildOf cwe_CWE_ID: 311 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 311 cwe_View_ID: 1003 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 311 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 922 cwe_View_ID: 1000

  • cwe_Nature: ChildOf cwe_CWE_ID: 922 cwe_View_ID: 699


Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

Paradigm: {'cwe_Name': 'Mobile', 'cwe_Prevalence': 'Undetermined'}


范围 影响 注释
Confidentiality Read Application Data An attacker with access to the system could read sensitive information stored in cleartext.


The following code excerpt stores a plaintext user account ID in a browser cookie.

bad Java

response.addCookie( new Cookie("userAccountID", acctID);

Because the account ID is in plaintext, the user's account information is exposed if their computer is compromised by an attacker.

This code writes a user's login information to a cookie so the user does not have to login again later.

bad PHP

function persistLogin($username, $password){
$data = array("username" => $username, "password"=> $password);
setcookie ("userdata", $data);

The code stores the user's username and password in plaintext in a cookie on the user's machine. This exposes the user's login information if their computer is compromised by an attacker. Even if the user's machine is not compromised, this weakness combined with cross-site scripting (CWE-79) could allow an attacker to remotely copy the cookie.

Also note this example code also exhibits Plaintext Storage in a Cookie (CWE-315).

The following code attempts to establish a connection, read in a password, then store it to a buffer.

bad C

server.sin_family = AF_INET; hp = gethostbyname(argv[1]);
if (hp==NULL) error("Unknown host");
memcpy( (char )&server.sin_addr,(char )hp->h_addr,hp->h_length);
if (argc < 3) port = 80;
else port = (unsigned short)atoi(argv[3]);
server.sin_port = htons(port);
if (connect(sock, (struct sockaddr *)&server, sizeof server) < 0) error("Connecting");
while ((n=read(sock,buffer,BUFSIZE-1))!=-1) {


While successful, the program does not encrypt the data before writing it to a buffer, possibly exposing it to unauthorized actors.

The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in plaintext.

This Java example shows a properties file with a plaintext username / password pair.

bad Java

# Java Web App ResourceBundle properties file

The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database but the pair is stored in plaintext.


<add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" />

Username and password information should not be included in a configuration file or a properties file in plaintext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information and avoid CWE-260 and CWE-13.


标识 说明 链接
CVE-2009-2272 password and username stored in cleartext in a cookie
CVE-2009-1466 password stored in cleartext in a file with insecure permissions
CVE-2009-0152 chat program disables SSL in some circumstances even when the user says to use SSL.
CVE-2009-1603 Chain: product uses an incorrect public exponent when generating an RSA key, which effectively disables the encryption
CVE-2009-0964 storage of unencrypted passwords in a database
CVE-2008-6157 storage of unencrypted passwords in a database
CVE-2008-6828 product stores a password in cleartext in memory
CVE-2008-1567 storage of a secret key in cleartext in a temporary file
CVE-2008-0174 SCADA product uses HTTP Basic Authentication, which is not encrypted
CVE-2007-5778 login credentials stored unencrypted in a registry key
CVE-2001-1481 Plaintext credentials in world-readable file.
CVE-2005-1828 Password in cleartext in config file.
CVE-2005-2209 Password in cleartext in config file.
CVE-2002-1696 Decrypted copy of a message written to disk given a combination of options and when user replies to an encrypted message.
CVE-2004-2397 Plaintext storage of private key and passphrase in log file when user imports the key.
CVE-2002-1800 Admin password in plaintext in a cookie.
CVE-2001-1537 Default configuration has cleartext usernames/passwords in cookie.
CVE-2001-1536 Usernames/passwords in cleartext in cookies.
CVE-2005-2160 Authentication information stored in cleartext in a cookie.



映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Plaintext Storage of Sensitive Information
Software Fault Patterns SFP23 Exposed Data


  • CAPEC-37