Skip to content
Log inStart free trial

CWE-319: Cleartext Transmission of Sensitive Information

BaseLikelihood of exploit: High

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Consequences

  • Integrity, Confidentiality: Read Application Data, Modify Files or Directories
  • Integrity, Confidentiality: Read Application Data, Modify Files or Directories, Other

How to prevent it

  • Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
  • Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
  • Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
  • Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
  • Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.

Recent advisories

  • GHSA-3wp9-xfwm-rjjf — AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
  • GHSA-jmqq-x5g9-9p2w — AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
  • GHSA-rqf5-2wxv-rjf4 — AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
  • GHSA-xr57-gcx8-52hf — AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request
  • GHSA-486v-q2wf-fp2r — rclone: http backend forwards custom/auth headers to a different host on redirect
  • GHSA-7mj9-2mp8-4m2p — HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
  • GHSA-vx52-2968-3vc6 — pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
  • PYSEC-2026-3797 — openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and…
  • GHSA-gx4c-2hqx-cw2r — rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect
  • GHSA-h4mf-4v27-hggj — rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect
  • GHSA-8mxv-9xhp-86h4 — rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys
  • GHSA-mm6v-q8q9-pgcf — Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
  • GHSA-chqv-56wv-7564 — Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
  • GHSA-x5w6-38gp-mrqh — Flowise: Password Reset Link Sent Over Unsecured HTTP
  • GHSA-83f3-hh45-vfw9 — OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

All advisories for CWE-319

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor