CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1095 vulnerabilities reference this CWE, most recent first.
GHSA-Q49H-QG5V-M8H5
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-05-24 17:42An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue.
{
"affected": [],
"aliases": [
"CVE-2021-27233"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-16T04:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue.",
"id": "GHSA-q49h-qg5v-m8h5",
"modified": "2022-05-24T17:42:22Z",
"published": "2022-05-24T17:42:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27233"
},
{
"type": "WEB",
"url": "https://www.mutare.com/security-adv-mutare-2021-004-mutare-voice"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q4VM-PQ3Q-8WGQ
Vulnerability from github – Published: 2026-07-14 20:17 – Updated: 2026-07-14 20:17Impact
Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours.
internal/models/operator.go:61—OperatorSession.Tokenholds the plaintext token.internal/store/sqlite_operators.go:590—CreateOperatorSessioninsertssess.Tokenverbatim.internal/store/sqlite_operators.go:603,642,681,698— lookups/updates/deletes useWHERE token = ?against the plaintext value.
Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication.
This is functionally identical to the plaintext enrollment-token issue fixed in GHSA-ghmh-jhmj-wcmf. API keys (OperatorAPIKey.KeyHash) and enrollment tokens (EnrollmentToken.TokenHash) already store only a SHA256 hash; session tokens were missed.
Patches
Store only a SHA256 hash of the session token, mirroring API keys and enrollment tokens:
1. Add a HashSessionToken helper (alongside the existing token-hash helpers).
2. Migration to add a token_hash column.
3. Update CreateOperatorSession, PromoteOperatorSession, and GetOperatorBySession to write/look up by hash.
4. Drop the plaintext token column in a follow-up migration.
Sessions are ephemeral (24h TTL), so all active sessions can be invalidated on deployment — no backward compatibility needed.
Workarounds
Restrict and encrypt database backups; rotate the operator database. These mitigate exposure but do not fix the underlying storage of plaintext tokens.
Resources
internal/models/operator.go:58-66internal/store/sqlite_operators.go:577-698- Migration
005_operators.up.sql:27 - Prior related advisory: GHSA-ghmh-jhmj-wcmf
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.3.7"
},
"package": {
"ecosystem": "Go",
"name": "github.com/forgekeep/nebula-mesh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53603"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-14T20:17:04Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Impact\n\nOperator session tokens are stored in plaintext in the `operator_sessions` table (the `token` column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours.\n\n- `internal/models/operator.go:61` \u2014 `OperatorSession.Token` holds the plaintext token.\n- `internal/store/sqlite_operators.go:590` \u2014 `CreateOperatorSession` inserts `sess.Token` verbatim.\n- `internal/store/sqlite_operators.go:603,642,681,698` \u2014 lookups/updates/deletes use `WHERE token = ?` against the plaintext value.\n\nAnyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication.\n\nThis is functionally identical to the plaintext enrollment-token issue fixed in GHSA-ghmh-jhmj-wcmf. API keys (`OperatorAPIKey.KeyHash`) and enrollment tokens (`EnrollmentToken.TokenHash`) already store only a SHA256 hash; session tokens were missed.\n\n## Patches\n\nStore only a SHA256 hash of the session token, mirroring API keys and enrollment tokens:\n1. Add a `HashSessionToken` helper (alongside the existing token-hash helpers).\n2. Migration to add a `token_hash` column.\n3. Update `CreateOperatorSession`, `PromoteOperatorSession`, and `GetOperatorBySession` to write/look up by hash.\n4. Drop the plaintext `token` column in a follow-up migration.\n\nSessions are ephemeral (24h TTL), so all active sessions can be invalidated on deployment \u2014 no backward compatibility needed.\n\n## Workarounds\n\nRestrict and encrypt database backups; rotate the operator database. These mitigate exposure but do not fix the underlying storage of plaintext tokens.\n\n## Resources\n\n- `internal/models/operator.go:58-66`\n- `internal/store/sqlite_operators.go:577-698`\n- Migration `005_operators.up.sql:27`\n- Prior related advisory: GHSA-ghmh-jhmj-wcmf",
"id": "GHSA-q4vm-pq3q-8wgq",
"modified": "2026-07-14T20:17:04Z",
"published": "2026-07-14T20:17:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-q4vm-pq3q-8wgq"
},
{
"type": "WEB",
"url": "https://github.com/forgekeep/nebula-mesh/commit/7cb01bab281ded557f8b6c81dab5f48d4c10182e"
},
{
"type": "PACKAGE",
"url": "https://github.com/forgekeep/nebula-mesh"
},
{
"type": "WEB",
"url": "https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "nebula-mesh: Operator session tokens stored in plaintext in the database"
}
GHSA-Q5CJ-XF99-79M8
Vulnerability from github – Published: 2023-12-13 18:31 – Updated: 2023-12-18 18:39Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.zintow:dingding-json-pusher"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-50773"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-13T19:44:18Z",
"nvd_published_at": "2023-12-13T18:15:44Z",
"severity": "MODERATE"
},
"details": "Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.",
"id": "GHSA-q5cj-xf99-79m8",
"modified": "2023-12-18T18:39:29Z",
"published": "2023-12-13T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50773"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/13/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Displayed in plain text by Dingding JSON Pusher Plugin "
}
GHSA-Q65C-V485-VHFQ
Vulnerability from github – Published: 2022-05-13 01:21 – Updated: 2022-05-13 01:21The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.
{
"affected": [],
"aliases": [
"CVE-2019-0285"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-10T21:29:00Z",
"severity": "CRITICAL"
},
"details": "The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.",
"id": "GHSA-q65c-v485-vhfq",
"modified": "2022-05-13T01:21:13Z",
"published": "2022-05-13T01:21:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0285"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2687663"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153471/SAP-Crystal-Reports-Information-Disclosure.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q6J3-9P27-59XC
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-06-26 21:31A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.
{
"affected": [],
"aliases": [
"CVE-2025-41647"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-25T10:15:22Z",
"severity": "MODERATE"
},
"details": "A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.",
"id": "GHSA-q6j3-9p27-59xc",
"modified": "2025-06-26T21:31:10Z",
"published": "2025-06-26T21:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41647"
},
{
"type": "WEB",
"url": "https://certvde.com/en/advisories/VDE-2025-043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q736-RGCP-Q443
Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2023-10-26 22:48Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Gogs Plugin now stores credentials encrypted.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.14"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:gogs-webhook"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10348"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-26T22:48:25Z",
"nvd_published_at": "2019-07-11T14:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Gogs Plugin stored credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.\n\nGogs Plugin now stores credentials encrypted.",
"id": "GHSA-q736-rgcp-q443",
"modified": "2023-10-26T22:48:25Z",
"published": "2022-05-24T16:50:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10348"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/gogs-webhook-plugin/commit/34de11fe0822864c4c340b395dadebca8cb11844"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1438"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/07/11/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Gogs Plugin stored credentials in plain text"
}
GHSA-Q7MH-G4JF-H3RV
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-07-13 00:01IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.
{
"affected": [],
"aliases": [
"CVE-2021-20410"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-12T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.",
"id": "GHSA-q7mh-g4jf-h3rv",
"modified": "2022-07-13T00:01:04Z",
"published": "2022-05-24T17:42:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20410"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196190"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6414773"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q7W7-VVPC-6QMP
Vulnerability from github – Published: 2023-02-11 03:32 – Updated: 2023-02-21 18:30Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability. A local malicious user with low privileges could exploit this vulnerability to view and modify sensitive information in the database of the affected application.
{
"affected": [],
"aliases": [
"CVE-2022-34388"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-11T01:23:00Z",
"severity": "HIGH"
},
"details": "Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability. A local malicious user with low privileges could exploit this vulnerability to view and modify sensitive information in the database of the affected application.",
"id": "GHSA-q7w7-vvpc-6qmp",
"modified": "2023-02-21T18:30:24Z",
"published": "2023-02-11T03:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34388"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/000204114"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q84X-3476-8FF2
Vulnerability from github – Published: 2023-01-06 12:31 – Updated: 2023-01-12 16:49Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.james:apache-mime4j-storage"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-45787"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-09T20:15:28Z",
"nvd_published_at": "2023-01-06T10:15:00Z",
"severity": "MODERATE"
},
"details": "Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.",
"id": "GHSA-q84x-3476-8ff2",
"modified": "2023-01-12T16:49:59Z",
"published": "2023-01-06T12:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45787"
},
{
"type": "WEB",
"url": "https://github.com/apache/james-mime4j/commit/021eb79ba312fe5a7f99fa867ee5350aa5533069"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/james-mime4j"
},
{
"type": "WEB",
"url": "https://github.com/apache/james-mime4j/blob/master/CHANGELOG.md#089---2022-12-30"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/MIME4J-322"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache James MIME4J vulnerable to information disclosure to local users"
}
GHSA-Q92V-3F4W-5XG8
Vulnerability from github – Published: 2025-07-09 18:30 – Updated: 2025-11-05 20:14Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:applitools-eyes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.16.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53742"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-09T22:37:55Z",
"nvd_published_at": "2025-07-09T16:15:27Z",
"severity": "MODERATE"
},
"details": "Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.",
"id": "GHSA-q92v-3f4w-5xg8",
"modified": "2025-11-05T20:14:09Z",
"published": "2025-07-09T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53742"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/applitools-eyes-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3510"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/07/09/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated users"
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.