CWE-312
AllowedCleartext Storage of Sensitive Information
Abstraction: Base · Status: Draft
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
1116 vulnerabilities reference this CWE, most recent first.
GHSA-8M4X-X8J4-MX4J
Vulnerability from github – Published: 2024-12-09 03:30 – Updated: 2024-12-09 03:30Oxide before 6 has unencrypted Control Plane datastores.
{
"affected": [],
"aliases": [
"CVE-2024-55582"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-09T03:15:05Z",
"severity": "MODERATE"
},
"details": "Oxide before 6 has unencrypted Control Plane datastores.",
"id": "GHSA-8m4x-x8j4-mx4j",
"modified": "2024-12-09T03:30:59Z",
"published": "2024-12-09T03:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55582"
},
{
"type": "WEB",
"url": "https://docs.oxide.computer/security/advisories/20240118-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8MJR-J93G-6X4Q
Vulnerability from github – Published: 2026-07-23 09:32 – Updated: 2026-07-23 09:32Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.
{
"affected": [],
"aliases": [
"CVE-2024-58023"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-23T09:16:26Z",
"severity": "HIGH"
},
"details": "Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.",
"id": "GHSA-8mjr-j93g-6x4q",
"modified": "2026-07-23T09:32:01Z",
"published": "2026-07-23T09:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58023"
},
{
"type": "WEB",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-981803.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8PH5-9XM8-J5VH
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-09-03 00:00An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/000000010000000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5.
{
"affected": [],
"aliases": [
"CVE-2020-29550"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-23T16:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/000000010000000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5.",
"id": "GHSA-8ph5-9xm8-j5vh",
"modified": "2022-09-03T00:00:25Z",
"published": "2022-05-24T17:37:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29550"
},
{
"type": "WEB",
"url": "https://urve.co.uk/system-rezerwacji-sal"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-042.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160726/URVE-Software-Build-24.03.2020-Information-Disclosure.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/49"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8PWJ-3GH6-824J
Vulnerability from github – Published: 2023-04-04 00:30 – Updated: 2025-02-13 15:31The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
{
"affected": [],
"aliases": [
"CVE-2023-0614"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-03T23:15:00Z",
"severity": "MODERATE"
},
"details": "The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.",
"id": "GHSA-8pwj-3gh6-824j",
"modified": "2025-02-13T15:31:20Z",
"published": "2023-04-04T00:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0614"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBPYIA4VWNOD437NAHZ3NXKAETLFB5S"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YXBPYIA4VWNOD437NAHZ3NXKAETLFB5S"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202309-06"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230406-0007"
},
{
"type": "WEB",
"url": "https://www.samba.org/samba/security/CVE-2023-0614.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8Q99-76CQ-4MC2
Vulnerability from github – Published: 2026-08-18 12:31 – Updated: 2026-08-18 12:31Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data.
This issue affects Cryptosim: before 3.1.0.229.
{
"affected": [],
"aliases": [
"CVE-2026-5224"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T12:19:28Z",
"severity": "MODERATE"
},
"details": "Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Cryptosim: before 3.1.0.229.",
"id": "GHSA-8q99-76cq-4mc2",
"modified": "2026-08-18T12:31:20Z",
"published": "2026-08-18T12:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5224"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0852"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8QR4-27MH-HQFR
Vulnerability from github – Published: 2026-06-24 15:31 – Updated: 2026-06-24 15:31Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
{
"affected": [],
"aliases": [
"CVE-2026-57287"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T14:17:34Z",
"severity": "MODERATE"
},
"details": "Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.",
"id": "GHSA-8qr4-27mh-hqfr",
"modified": "2026-06-24T15:31:47Z",
"published": "2026-06-24T15:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57287"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3742"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8R89-3G9F-5G2P
Vulnerability from github – Published: 2022-05-24 17:48 – Updated: 2022-05-24 17:48Wowza Streaming Engine through 4.8.5 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords.
{
"affected": [],
"aliases": [
"CVE-2021-31539"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-23T17:15:00Z",
"severity": "MODERATE"
},
"details": "Wowza Streaming Engine through 4.8.5 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords.",
"id": "GHSA-8r89-3g9f-5g2p",
"modified": "2022-05-24T17:48:21Z",
"published": "2022-05-24T17:48:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31539"
},
{
"type": "WEB",
"url": "https://www.gruppotim.it/redteam"
},
{
"type": "WEB",
"url": "https://www.wowza.com/docs/wowza-streaming-engine-4-8-8-01-release-notes#breaking"
},
{
"type": "WEB",
"url": "https://www.wowza.com/products/streaming-engine"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8RCH-M472-JJM3
Vulnerability from github – Published: 2022-09-02 00:01 – Updated: 2022-09-08 00:00IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554.
{
"affected": [],
"aliases": [
"CVE-2021-39009"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-01T19:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 213554.",
"id": "GHSA-8rch-m472-jjm3",
"modified": "2022-09-08T00:00:33Z",
"published": "2022-09-02T00:01:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39009"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/213554"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221014-0005"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6615285"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8RHQ-WWG6-2476
Vulnerability from github – Published: 2022-05-13 01:48 – Updated: 2022-05-13 01:48The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency by leveraging root access to read /com.biepie/shared_prefs/com.bitpie_preferences.xml (on Android) or a plist file in the app data folder (on iOS).
{
"affected": [],
"aliases": [
"CVE-2018-10812"
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-08T19:29:00Z",
"severity": "MODERATE"
},
"details": "The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency by leveraging root access to read /com.biepie/shared_prefs/com.bitpie_preferences.xml (on Android) or a plist file in the app data folder (on iOS).",
"id": "GHSA-8rhq-wwg6-2476",
"modified": "2022-05-13T01:48:57Z",
"published": "2022-05-13T01:48:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10812"
},
{
"type": "WEB",
"url": "https://github.com/edwardz246003/misc/blob/master/Bitpie%20CVE-2018-10812..md"
},
{
"type": "WEB",
"url": "https://github.com/edwardz246003/misc/blob/master/Bitpie.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8RQ7-P3VQ-FH83
Vulnerability from github – Published: 2022-09-10 00:00 – Updated: 2022-09-16 00:00The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.
{
"affected": [],
"aliases": [
"CVE-2022-26390"
],
"database_specific": {
"cwe_ids": [
"CWE-311",
"CWE-312"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-09T15:15:00Z",
"severity": "MODERATE"
},
"details": "The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn\u0027t had all data and settings erased may be able to extract sensitive information.",
"id": "GHSA-8rq7-p3vq-fh83",
"modified": "2022-09-16T00:00:38Z",
"published": "2022-09-10T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26390"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Mitigation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.