CWEweakness

CWE-316 Cleartext Storage of Sensitive Information in Memory

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product stores sensitive information in cleartext in memory.

Common consequences

• Confidentiality: Read Memory — Memory could be read by attackers with administrator privileges, which may be a concern in some threat models. However, even without admin privileges, swapping could cause the memory to be written to disk and leave it accessible to physical attack afterwards. Core dump files might have insecure permissions or be stored in archive files that are accessible to untrusted people. Or, uncleared sensitive memory might be inadvertently exposed to attackers due to another weakness.

Observed examples

• CVE-2025-24870: GUI for a desktop client stores credentials in program memory, allowing privilege escalation • CVE-2001-1517: Sensitive authentication information in cleartext in memory. • CVE-2001-0984: Password protector leaves passwords in memory when window is minimized, even when "clear password when minimized" is set. • CVE-2003-0291: SSH client does not clear credentials from memory.

Related

Observed example · CVE (4)

  • CVE-2025-24870 SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to… vulnerability
  • CVE-2003-0291 3com OfficeConnect Remote 812 ADSL Router 1.1.7 does not properly clear memory from DHCP responses, which allows remote attackers to… vulnerability
  • CVE-2001-1517 RunAs (runas.exe) in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames… vulnerability
  • CVE-2001-0984 Password Safe 1.7(1) leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with… vulnerability

Child of · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

Referenced by CVE · weakness (42)

  • CVE-2026-71455 Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive… vulnerability
  • CVE-2025-56565 DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within… vulnerability
  • CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. vulnerability
  • CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. vulnerability
  • CVE-2026-75135 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master… vulnerability
  • CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault… vulnerability
  • CVE-2026-27875 Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire… vulnerability
  • CVE-2026-8636 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and… vulnerability
  • CVE-2026-24319 In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. vulnerability
  • CVE-2025-65832 The mobile application insecurely handles information stored within memory. vulnerability
  • CVE-2025-60794 Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in… vulnerability
  • CVE-2025-61713 A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions,… vulnerability
  • CVE-2025-4618 A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to… vulnerability
  • CVE-2025-42888 SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process… vulnerability
  • CVE-2025-60791 Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. vulnerability
  • CVE-2025-9970 Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21. vulnerability
  • CVE-2025-50109 Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere. vulnerability
  • CVE-2025-52579 Emerson ValveLink Products store sensitive information in cleartext in memory. vulnerability
  • CVE-2024-24915 Credentials are not cleared from memory after being used. vulnerability
  • CVE-2025-48930 The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to… vulnerability
  • CVE-2024-49800 IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user. vulnerability
  • CVE-2024-9203 A vulnerability, which was classified as problematic, has been found in Enpass Password Manager up to 6.9.5 on Windows. vulnerability
  • CVE-2024-35282 A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all… vulnerability
  • CVE-2024-39732 IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a… vulnerability
  • CVE-2024-36792 An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's… vulnerability
  • CVE-2024-33900 KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory dump. vulnerability
  • CVE-2024-33901 Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in the .kdbx database… vulnerability
  • CVE-2023-23349 Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled… vulnerability
  • CVE-2024-25649 In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the… vulnerability
  • CVE-2022-46141 A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). vulnerability
Show all 42 ›

Referenced by OWASP · mapped cwe (2)