CWEweakness
CWE-549 Missing Password Field Masking
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
Common consequences
• Access Control: Bypass Protection Mechanism
Potential mitigations
• [Implementation, Requirements] Recommendations include requiring all password fields in your web application be masked to prevent other users from seeing this information.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2025-0148: Jenkins plugin for a video meeting product does not mask passwords
Related
Observed example · CVE (1)
- CVE-2025-0148 Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a… vulnerability
Child of · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
Referenced by CVE · weakness (16)
- CVE-2026-3314 Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center… vulnerability
- CVE-2025-13175 Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to reveal the value using… vulnerability
- CVE-2025-42904 Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed… vulnerability
- CVE-2025-64170 sudo-rs is a memory safe implementation of sudo and su written in Rust. vulnerability
- CVE-2025-4526 A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. vulnerability
- CVE-2025-31727 Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins… vulnerability
- CVE-2025-31728 Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form,… vulnerability
- CVE-2025-30197 Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for… vulnerability
- CVE-2025-0148 Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a… vulnerability
- CVE-2024-10122 A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. vulnerability
- CVE-2023-49106 Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue… vulnerability
- CVE-2023-2062 Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and… vulnerability
- CVE-2023-1763 Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X… vulnerability
- CVE-2022-20914 A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated,… vulnerability
- CVE-2022-1342 A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. vulnerability
- CVE-2022-22550 Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. vulnerability