CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1097 vulnerabilities reference this CWE, most recent first.
GHSA-6R5W-JJR5-QVGR
Vulnerability from github – Published: 2023-12-13 18:31 – Updated: 2024-11-15 22:26Jenkins OpenId Connect Authentication Plugin stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:oic-auth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.229.vf736b"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-50770"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-13T19:34:24Z",
"nvd_published_at": "2023-12-13T18:15:44Z",
"severity": "MODERATE"
},
"details": "Jenkins OpenId Connect Authentication Plugin stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.",
"id": "GHSA-6r5w-jjr5-qvgr",
"modified": "2024-11-15T22:26:42Z",
"published": "2023-12-13T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50770"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/oic-auth-plugin/issues/259"
},
{
"type": "WEB",
"url": "https://github.com/jenkins-infra/update-center2/pull/773"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/oic-auth-plugin/pull/287"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/oic-auth-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/13/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin "
}
GHSA-6RG8-WQVX-GHG5
Vulnerability from github – Published: 2025-03-10 15:30 – Updated: 2026-06-01 15:30Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misuse.This issue affects Tap&Sign App: before V.1.025.
{
"affected": [],
"aliases": [
"CVE-2024-12604"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-526"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-10T15:15:36Z",
"severity": "HIGH"
},
"details": "Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap\u0026Sign App allows Password Recovery Exploitation, Functionality Misuse.This issue affects Tap\u0026Sign App: before V.1.025.",
"id": "GHSA-6rg8-wqvx-ghg5",
"modified": "2026-06-01T15:30:32Z",
"published": "2025-03-10T15:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12604"
},
{
"type": "WEB",
"url": "https://docs.tapandsign.com/tap-and-sign/tap-and-sign-v.1.025-surum-notlari"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0063"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0063"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6V48-P2G5-G5G2
Vulnerability from github – Published: 2024-09-12 15:33 – Updated: 2024-10-31 21:31No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.
{
"affected": [],
"aliases": [
"CVE-2024-40457"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-313"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-12T14:16:06Z",
"severity": "CRITICAL"
},
"details": "No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor\u0027s position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.",
"id": "GHSA-6v48-p2g5-g5g2",
"modified": "2024-10-31T21:31:44Z",
"published": "2024-09-12T15:33:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40457"
},
{
"type": "WEB",
"url": "https://github.com/jeppojeps/CVE-2024-40457-PoC"
},
{
"type": "WEB",
"url": "https://www.noip.com/support/knowledgebase/install-linux-3-x-dynamic-update-client-duc"
},
{
"type": "WEB",
"url": "https://www.noip.com/support/knowledgebase/running-linux-duc-v3-0-startup-2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6VFQ-JMXG-G58R
Vulnerability from github – Published: 2022-09-16 21:02 – Updated: 2022-09-16 21:02Impact
The request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID.
Patches
We recommend updating to the current version 5.7.15. You can get the update to 5.7.15 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/changelog-sw5/#5-7-15
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.7.14"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/shopware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.7.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-36101"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T21:02:55Z",
"nvd_published_at": "2022-09-12T20:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID.\n\n### Patches\nWe recommend updating to the current version 5.7.15. You can get the update to 5.7.15 regularly via the Auto-Updater or directly via the download overview.\nhttps://www.shopware.com/en/changelog-sw5/#5-7-15\n\nFor older versions you can use the Security Plugin:\nhttps://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html\n\n\n### References\nhttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022",
"id": "GHSA-6vfq-jmxg-g58r",
"modified": "2022-09-16T21:02:55Z",
"published": "2022-09-16T21:02:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/security/advisories/GHSA-6vfq-jmxg-g58r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36101"
},
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/commit/af5cdbc81d60f21b728e1433aeb8837f25938d2a"
},
{
"type": "WEB",
"url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopware/shopware"
},
{
"type": "WEB",
"url": "https://packagist.org/packages/shopware/shopware"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Shopware contains sensitive data in backend customer module"
}
GHSA-6W7R-4V6H-JJQ5
Vulnerability from github – Published: 2022-12-12 18:30 – Updated: 2022-12-15 18:30A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card.
{
"affected": [],
"aliases": [
"CVE-2022-4312"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-12T18:15:00Z",
"severity": "MODERATE"
},
"details": "A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card.",
"id": "GHSA-6w7r-4v6h-jjq5",
"modified": "2022-12-15T18:30:24Z",
"published": "2022-12-12T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4312"
},
{
"type": "WEB",
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1171-security-bulletin-2022-7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6XPF-79GP-9FC2
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC.
{
"affected": [],
"aliases": [
"CVE-2020-5805"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-08T16:15:00Z",
"severity": "HIGH"
},
"details": "In Marvell QConvergeConsole GUI \u003c= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC.",
"id": "GHSA-6xpf-79gp-9fc2",
"modified": "2022-05-24T17:38:22Z",
"published": "2022-05-24T17:38:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5805"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2021-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XPQ-789W-CRHJ
Vulnerability from github – Published: 2023-06-11 15:30 – Updated: 2024-10-16 12:30The Danfoss AK-EM100 stores login credentials in cleartext.
{
"affected": [],
"aliases": [
"CVE-2023-22584"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-11T14:15:09Z",
"severity": "HIGH"
},
"details": "The Danfoss AK-EM100 stores login credentials in cleartext.",
"id": "GHSA-6xpq-789w-crhj",
"modified": "2024-10-16T12:30:47Z",
"published": "2023-06-11T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22584"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/CVE-2023-22584"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/DIVD-2023-00021"
},
{
"type": "WEB",
"url": "https://divd.nl/cves/CVE-2023-22584"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-723J-VWR2-6865
Vulnerability from github – Published: 2023-03-23 18:30 – Updated: 2023-03-30 21:30A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged user credentials. This vulnerability is due to improper role-based access control (RBAC) with the integration of PnP. An attacker could exploit this vulnerability by authenticating to the device and sending a query to an internal API. A successful exploit could allow the attacker to view sensitive information in clear text, which could include configuration files.
{
"affected": [],
"aliases": [
"CVE-2023-20059"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-555"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-23T17:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the implementation of the Cisco Network Plug-and-Play (PnP) agent of Cisco DNA Center could allow an authenticated, remote attacker to view sensitive information in clear text. The attacker must have valid low-privileged user credentials. This vulnerability is due to improper role-based access control (RBAC) with the integration of PnP. An attacker could exploit this vulnerability by authenticating to the device and sending a query to an internal API. A successful exploit could allow the attacker to view sensitive information in clear text, which could include configuration files.",
"id": "GHSA-723j-vwr2-6865",
"modified": "2023-03-30T21:30:23Z",
"published": "2023-03-23T18:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20059"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-infodisc-pe7zAbdR"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-72GJ-XRP6-846V
Vulnerability from github – Published: 2025-04-09 09:31 – Updated: 2025-04-09 09:31This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.
{
"affected": [],
"aliases": [
"CVE-2025-3442"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-09T07:15:41Z",
"severity": "MODERATE"
},
"details": "This vulnerability exists in TP-Link Tapo\u00a0H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.",
"id": "GHSA-72gj-xrp6-846v",
"modified": "2025-04-09T09:31:24Z",
"published": "2025-04-09T09:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3442"
},
{
"type": "WEB",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2025-0072"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-72M7-8X56-R97P
Vulnerability from github – Published: 2026-08-21 09:32 – Updated: 2026-08-25 21:31Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.
This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-59657"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-21T09:16:38Z",
"severity": "HIGH"
},
"details": "Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.\n\nThis issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
"id": "GHSA-72m7-8x56-r97p",
"modified": "2026-08-25T21:31:21Z",
"published": "2026-08-21T09:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59657"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.