CWEweakness

CWE-317 Cleartext Storage of Sensitive Information in GUI

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product stores sensitive information in cleartext within the GUI.

Common consequences

• Confidentiality: Read Memory, Read Application Data — An attacker can often obtain data from a GUI, even if hidden, by using an API to directly access GUI objects such as windows and menus. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Observed examples

• CVE-2002-1848: Unencrypted passwords stored in GUI dialog may allow local users to access the passwords.

Related

Observed example · CVE (1)

  • CVE-2002-1848 TightVNC before 1.2.4 running on Windows stores unencrypted passwords in the password text control of the WinVNC Properties dialog, which… vulnerability

Child of · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

Referenced by CVE · weakness (8)

  • CVE-2025-14816 Cleartext Storage of Sensitive Information in GUI vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi… vulnerability
  • CVE-2026-27516 Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the… vulnerability
  • CVE-2026-24431 Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within… vulnerability
  • CVE-2021-34750 A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center Software could allow an… vulnerability
  • CVE-2021-34751 A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software could allow… vulnerability
  • CVE-2022-29090 Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. vulnerability
  • CVE-2022-0354 A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute… vulnerability
  • CVE-2019-13947 A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). vulnerability