CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1158 vulnerabilities reference this CWE, most recent first.
GHSA-8733-RHX2-3GXR
Vulnerability from github – Published: 2023-09-13 15:31 – Updated: 2024-04-04 07:39A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to retrieve the plaintext password of external servers configured in the device.
{
"affected": [],
"aliases": [
"CVE-2023-40715"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-13T13:15:09Z",
"severity": "MODERATE"
},
"details": "A cleartext storage of sensitive information vulnerability [CWE-312] in\u00a0FortiTester\u00a02.3.0 through 7.2.3 may allow\u00a0an attacker with access to the DB contents to retrieve the plaintext password of external servers configured in the device.",
"id": "GHSA-8733-rhx2-3gxr",
"modified": "2024-04-04T07:39:14Z",
"published": "2023-09-13T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40715"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-22-465"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8772-675X-8FVX
Vulnerability from github – Published: 2022-05-02 03:26 – Updated: 2025-04-09 04:09src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted.
{
"affected": [],
"aliases": [
"CVE-2009-1603"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-05-11T16:30:00Z",
"severity": "MODERATE"
},
"details": "src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted.",
"id": "GHSA-8772-675x-8fvx",
"modified": "2025-04-09T04:09:40Z",
"published": "2022-05-02T03:26:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1603"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00095.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00097.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01420.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01432.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35035"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35293"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35309"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36074"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200908-01.xml"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:123"
},
{
"type": "WEB",
"url": "http://www.opensc-project.org/pipermail/opensc-announce/2009-May/000025.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/05/08/1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1295"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8886-48WG-HX3V
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.
{
"affected": [],
"aliases": [
"CVE-2020-28917"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-18T09:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.",
"id": "GHSA-8886-48wg-hx3v",
"modified": "2022-05-24T17:34:34Z",
"published": "2022-05-24T17:34:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28917"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2020-019"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-88F6-4RJV-X774
Vulnerability from github – Published: 2026-10-09 20:51 – Updated: 2026-10-09 20:51Summary
Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into your own authenticator and keep generating valid codes indefinitely.
Details
GET /api/v1/user/settings/totp returns the full TOTP object, including the secret field and the otpauth:// provisioning URL. GET /api/v1/user/settings/totp/qrcode renders the same secret as a QR image. Neither requires re-authentication, the access token alone is enough.
This is inconsistent with the rest of the flow: POST /api/v1/user/settings/totp/disable calls CheckUserPassword before it will turn TOTP off. So the destructive action is gated behind the password, but reading out the secret that backs the second factor isn't. There's also no reason for the secret to be readable at all once enrollment is finished, the client only needs it during setup.
The fix is to stop returning secret/url/the QR code once enabled is true (only expose them during the enrollment window). Requiring the password on the read, like disable already does, would also be reasonable.
PoC
The attacker needs the victim's access token, from an XSS, a leaked/stolen token, or an unlocked session. TOTP must already be enabled on the account.
- With the victim's bearer token, call:
GET /api/v1/user/settings/totp
Authorization: Bearer <victim_token>
The response contains the shared secret and the otpauth:// URL:
{"secret": "<base32 secret>", "enabled": true, "url": "otpauth://totp/..."}
- Paste that secret (or scan
/api/v1/user/settings/totp/qrcode) into any authenticator app. - It now produces the same 6-digit codes as the victim's device. Nothing is logged and the victim gets no notification.
Impact
This defeats the purpose of the second factor. 2FA is supposed to survive exactly this situation, a compromised password or a hijacked session, but a single read of the account's own settings hands over the shared secret with no step-up check and no trace. Combined with a known or later-recovered password, it's a durable account takeover that TOTP was meant to prevent.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.0"
},
"package": {
"ecosystem": "Go",
"name": "code.vikunja.io/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-91982"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-09T20:51:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nOnce a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account\u0027s access token. Reading it doesn\u0027t ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into your own authenticator and keep generating valid codes indefinitely.\n\n### Details\n`GET /api/v1/user/settings/totp` returns the full TOTP object, including the secret field and the otpauth:// provisioning URL. `GET /api/v1/user/settings/totp/qrcode` renders the same secret as a QR image. Neither requires re-authentication, the access token alone is enough.\n\nThis is inconsistent with the rest of the flow: `POST /api/v1/user/settings/totp/disable` calls CheckUserPassword before it will turn TOTP off. So the destructive action is gated behind the password, but reading out the secret that backs the second factor isn\u0027t. There\u0027s also no reason for the secret to be readable at all once enrollment is finished, the client only needs it during setup.\n\nThe fix is to stop returning secret/url/the QR code once enabled is true (only expose them during the enrollment window). Requiring the password on the read, like disable already does, would also be reasonable.\n\n### PoC\nThe attacker needs the victim\u0027s access token, from an XSS, a leaked/stolen token, or an unlocked session. TOTP must already be enabled on the account.\n\n1. With the victim\u0027s bearer token, call:\n```\nGET /api/v1/user/settings/totp\nAuthorization: Bearer \u003cvictim_token\u003e\n```\nThe response contains the shared secret and the otpauth:// URL:\n```\n{\"secret\": \"\u003cbase32 secret\u003e\", \"enabled\": true, \"url\": \"otpauth://totp/...\"}\n```\n2. Paste that secret (or scan `/api/v1/user/settings/totp/qrcode`) into any authenticator app.\n3. It now produces the same 6-digit codes as the victim\u0027s device. Nothing is logged and the victim gets no notification.\n\n### Impact\nThis defeats the purpose of the second factor. 2FA is supposed to survive exactly this situation, a compromised password or a hijacked session, but a single read of the account\u0027s own settings hands over the shared secret with no step-up check and no trace. Combined with a known or later-recovered password, it\u0027s a durable account takeover that TOTP was meant to prevent.",
"id": "GHSA-88f6-4rjv-x774",
"modified": "2026-10-09T20:51:17Z",
"published": "2026-10-09T20:51:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91982"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/pull/3688"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-vikunja/vikunja"
},
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.6.0-totp-secret-disclosure-via-api"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Vikunja: TOTP secret is readable after enrollment, no step-up auth"
}
GHSA-899F-6CWW-CVCV
Vulnerability from github – Published: 2026-10-22 06:31 – Updated: 2026-10-22 06:31NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-114223"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-22T05:16:50Z",
"severity": "MODERATE"
},
"details": "NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.",
"id": "GHSA-899f-6cww-cvcv",
"modified": "2026-10-22T06:31:19Z",
"published": "2026-10-22T06:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114223"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-11298-d9dd5-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-899F-9GPG-R429
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-157474195
{
"affected": [],
"aliases": [
"CVE-2021-0337"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-10T17:15:00Z",
"severity": "HIGH"
},
"details": "In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-157474195",
"id": "GHSA-899f-9gpg-r429",
"modified": "2022-05-24T17:41:44Z",
"published": "2022-05-24T17:41:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0337"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2021-02-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-89FF-5HGP-6W8J
Vulnerability from github – Published: 2023-12-26 09:30 – Updated: 2024-01-02 21:30The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.
{
"affected": [],
"aliases": [
"CVE-2023-50294"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-26T08:15:11Z",
"severity": "MODERATE"
},
"details": "The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.",
"id": "GHSA-89ff-5hgp-6w8j",
"modified": "2024-01-02T21:30:25Z",
"published": "2023-12-26T09:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50294"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN18715935"
},
{
"type": "WEB",
"url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8CMP-CRM3-JRH4
Vulnerability from github – Published: 2022-09-30 00:00 – Updated: 2022-09-30 00:00Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.
{
"affected": [],
"aliases": [
"CVE-2020-15332"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-29T03:15:00Z",
"severity": "CRITICAL"
},
"details": "Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.",
"id": "GHSA-8cmp-crm3-jrh4",
"modified": "2022-09-30T00:00:33Z",
"published": "2022-09-30T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15332"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8CXR-CQ5C-VWMW
Vulnerability from github – Published: 2023-01-13 03:30 – Updated: 2023-01-24 18:30NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure.
{
"affected": [],
"aliases": [
"CVE-2022-42284"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-13T02:15:00Z",
"severity": "MODERATE"
},
"details": "NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure.",
"id": "GHSA-8cxr-cq5c-vwmw",
"modified": "2023-01-24T18:30:32Z",
"published": "2023-01-13T03:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42284"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5435"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8F47-4RH3-X44M
Vulnerability from github – Published: 2026-05-06 15:32 – Updated: 2026-05-12 22:22A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-8026"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-12T22:22:13Z",
"nvd_published_at": "2026-05-06T13:16:10Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.",
"id": "GHSA-8f47-4rh3-x44m",
"modified": "2026-05-12T22:22:13Z",
"published": "2026-05-06T15:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8026"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/777656"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/361273"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/361273/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Flowise: Bcrypt Password Hash Exposure"
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.