CWEweakness
CWE-922 Insecure Storage of Sensitive Information
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Common consequences
• Confidentiality: Read Application Data, Read Files or Directories — Attackers can read sensitive information by accessing the unrestricted storage mechanism.
• Integrity: Modify Application Data, Modify Files or Directories — Attackers can overwrite and possibly delete sensitive information by accessing the unrestricted storage mechanism, causing incorrect results and possibly a denial of service.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2009-2272: password and username stored in cleartext in a cookie
Related
Observed example · CVE (1)
- CVE-2009-2272 The Huawei D100 stores the administrator's account name and password in cleartext in a cookie, which allows context-dependent attackers to… vulnerability
Child of · CWE (1)
- CWE-664 Improper Control of a Resource Through its Lifetime weakness
Referenced by CVE · weakness (385)
- CVE-2026-109822 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. vulnerability
- CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. vulnerability
- CVE-2026-91477 Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). vulnerability
- CVE-2026-82153 Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. vulnerability
- CVE-2026-89075 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. vulnerability
- CVE-2026-5047 A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. vulnerability
- CVE-2026-84283 Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. vulnerability
- CVE-2026-77875 The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication… vulnerability
- CVE-2026-44629 Improper access control to the Synergis Softwire installation folder. vulnerability
- CVE-2025-59320 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. vulnerability
- CVE-2026-20705 Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow… vulnerability
- CVE-2026-47362 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext:… vulnerability
- CVE-2026-46511 HAX CMS helps manage microsite universe with PHP or NodeJs backends. vulnerability
- CVE-2026-5515 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local… vulnerability
- CVE-2025-32746 Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. vulnerability
- CVE-2025-32751 Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. vulnerability
- CVE-2026-7257 ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2… vulnerability
- CVE-2026-40868 Kyverno is a policy engine designed for cloud native platform engineering teams. vulnerability
- CVE-2026-26152 Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally. vulnerability
- CVE-2026-5650 A vulnerability was found in code-projects Online Application System for Admission 1.0. vulnerability
- CVE-2026-5666 A vulnerability was detected in code-projects Online FIR System 1.0. vulnerability
- CVE-2026-33407 Wallos is an open-source, self-hostable personal subscription tracker. vulnerability
- CVE-2025-10734 The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is… vulnerability
- CVE-2026-20629 A privacy issue was addressed with improved handling of temporary files. vulnerability
- CVE-2025-10464 Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. vulnerability
- CVE-2025-70963 Gophish <=0.12.1 is vulnerable to Incorrect Access Control. vulnerability
- CVE-2025-14376 A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in… vulnerability
- CVE-2025-10971 Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. vulnerability
- CVE-2025-12539 The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,… vulnerability
- CVE-2025-61482 Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root… vulnerability
Referenced by CWE · child of (2)
Referenced by CWE · has member (1)
- CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities view