CWE-313 Cleartext Storage in a File or on Disk

The product stores sensitive information in cleartext in a file, or on disk.

• Confidentiality: Read Application Data, Read Files or Directories — The sensitive information could be read by attackers with access to the file, or with physical or administrator access to the raw disk. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2001-1481: Cleartext credentials in world-readable file. • CVE-2005-1828: Password in cleartext in config file. • CVE-2005-2209: Password in cleartext in config file. • CVE-2002-1696: Decrypted copy of a message written to disk given a combination of options and when user replies to an encrypted message. • CVE-2004-2397: Cleartext storage of private key and passphrase in log file when user imports the key.