CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

• Access Control: Gain Privileges or Assume Identity — An attacker could gain access to user accounts and access sensitive data used by the user accounts.

• [Architecture and Design] Use an appropriate security mechanism to protect the credentials. • [Architecture and Design] Make appropriate use of cryptography to protect the credentials. • [Implementation] Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2022-30018: A messaging platform serializes all elements of User/Group objects, making private information available to adversaries • CVE-2022-29959: Initialization file contains credentials that can be decoded using a "simple string transformation" • CVE-2022-35411: Python-based RPC framework enables pickle functionality by default, allowing clients to unpickle untrusted data. • CVE-2022-29519: Programmable Logic Controller (PLC) sends sensitive information in plaintext, including passwords and session tokens. • CVE-2022-30312: Building Controller uses a protocol that transmits authentication credentials in plaintext. • CVE-2022-31204: Programmable Logic Controller (PLC) sends password in plaintext. • CVE-2022-30275: Remote Terminal Unit (RTU) uses a driver that relies on a password stored in plaintext. • CVE-2007-0681: Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions. • CVE-2000-0944: Web application password change utility doesn't check the original password. • CVE-2005-3435: product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks. • CVE-2005-0408: Chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.