CWEweakness
CWE-315 Cleartext Storage of Sensitive Information in a Cookie
- Abstraction
- Variant
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product stores sensitive information in cleartext in a cookie.
Common consequences
• Confidentiality: Read Application Data — Attackers can use widely-available tools to view the cookie and read the sensitive information. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2002-1800: Admin password in cleartext in a cookie.
• CVE-2001-1537: Default configuration has cleartext usernames/passwords in cookie.
• CVE-2001-1536: Usernames/passwords in cleartext in cookies.
• CVE-2005-2160: Authentication information stored in cleartext in a cookie.
Related
Attack pattern · CAPEC (4)
Observed example · CVE (4)
- CVE-2005-2160 IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information. vulnerability
- CVE-2002-1800 phpRank 1.8 stores the administrative password in plaintext on the server and in the "ap" cookie, which allows remote attackers to retrieve… vulnerability
- CVE-2001-1536 Autogalaxy stores usernames and passwords in cleartext in cookies, which makes it easier for remote attackers to obtain authentication… vulnerability
- CVE-2001-1537 The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies,… vulnerability
Child of · CWE (1)
- CWE-312 Cleartext Storage of Sensitive Information weakness
Referenced by CAPEC · weakness (4)
Referenced by CVE · weakness (8)
- CVE-2026-25818 HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3… vulnerability
- CVE-2025-8528 A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. vulnerability
- CVE-2025-4537 A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. vulnerability
- CVE-2024-41290 FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. vulnerability
- CVE-2024-8644 Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON… vulnerability
- CVE-2024-24768 1Panel is an open source Linux server operation and maintenance management panel. vulnerability
- CVE-2021-34564 Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the… vulnerability
- CVE-2018-19941 A vulnerability has been reported to affect QNAP NAS. vulnerability