CWEweakness
CWE-260 Password in Configuration File
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
Common consequences
• Access Control: Gain Privileges or Assume Identity — This can result in compromise of the system for which the password is used. An attacker could gain access to this file and learn the stored password or worse yet, change the password to one of their choosing.
Potential mitigations
• [Architecture and Design] Avoid storing passwords in easily accessible locations.
• [Architecture and Design] Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2022-38665: A continuous delivery pipeline management tool stores an unencypted password in a configuration file.
Related
Observed example · CVE (1)
- CVE-2022-38665 Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins… vulnerability
Child of · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
Referenced by CVE · weakness (25)
- CVE-2026-103548 Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to… vulnerability
- CVE-2019-25465 Hisilicon HiIpcam V100R003 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive… vulnerability
- CVE-2025-15151 A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0. vulnerability
- CVE-2023-53739 Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download… vulnerability
- CVE-2023-53770 MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system… vulnerability
- CVE-2025-33119 IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an… vulnerability
- CVE-2025-36002 IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores… vulnerability
- CVE-2025-36100 IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0… vulnerability
- CVE-2025-57754 eslint-ban-moment is an Eslint plugin for final assignment in VIHU. vulnerability
- CVE-2025-51540 EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). vulnerability
- CVE-2025-6513 Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it. vulnerability
- CVE-2025-25022 IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an… vulnerability
- CVE-2025-33093 IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes… vulnerability
- CVE-2025-32111 The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for… vulnerability
- CVE-2024-45673 IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM… vulnerability
- CVE-2024-49817 IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read… vulnerability
- CVE-2023-34128 Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. vulnerability
- CVE-2023-2790 A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. vulnerability
- CVE-2021-35033 A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password… vulnerability
- CVE-2020-5721 MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field… vulnerability
- CVE-2016-7043 It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java… vulnerability
- CVE-2019-3780 Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS… vulnerability
- CVE-2017-7923 A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530,… vulnerability
- CVE-2017-7925 A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX,… vulnerability
- CVE-2014-5400 The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to… vulnerability