CWEweakness

CWE-314 Cleartext Storage in the Registry

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product stores sensitive information in cleartext in the registry.

Common consequences

• Confidentiality: Read Application Data — Attackers can read the information by accessing the registry key. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Observed examples

• CVE-2005-2227: Cleartext passwords in registry key.

Related

Attack pattern · CAPEC (1)

  • CAPEC-37 Retrieve Embedded Sensitive Data attack pattern

Observed example · CVE (1)

  • CVE-2005-2227 Softiacom wMailserver 1.0 stores passwords in plaintext in the Darsite\MAILSRV\Admin key, which allows local users to gain administrator… vulnerability

Child of · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

Referenced by CAPEC · weakness (1)

  • CAPEC-37 Retrieve Embedded Sensitive Data attack pattern

Referenced by CVE · weakness (1)

  • CVE-2023-2335 Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows… vulnerability