CWE-256: Plaintext Storage of a Password
BaseLikelihood of exploit: High
The product stores a password in plaintext within resources such as memory or files.
Consequences
- Access Control: Gain Privileges or Assume Identity
How to prevent it
- Architecture and Design: Avoid storing passwords in easily accessible locations.
- Architecture and Design: Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
- A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Recent advisories
- GHSA-5jjf-wcvf-923w — Langflow has an Information Leak through Incomplete API Key Redaction
- GHSA-h3m5-p59h-x88p — openssl-encrypt has visible password in process list via --password CLI argument
- GHSA-v722-jcv5-w7mc — NATS has MQTT plaintext password disclosure
- GHSA-mpp2-x7wv-38hv — NocoDB has Plaintext Storage of Shared View Passwords
- GHSA-q6c7-56cq-g2wm — Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
- GHSA-wj85-rg5g-v8jm — TYPO3 Information Disclosure in User Authentication
- GHSA-5q66-v53q-pm35 — Keycloak vulnerable to Plaintext Storage of User Password
- GHSA-cq4p-vp5q-4522 — Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor