The product stores sensitive information in cleartext within the GUI.
An attacker can often obtain data from a GUI, even if hidden, by using an API to directly access GUI objects such as windows and menus. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Allowed | B | 312 | Cleartext Storage of Sensitive Information |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 963 | SFP Secondary Cluster: Exposed Data |
| MemberOf | Prohibited | C | 1013 | Encrypt Data |
| MemberOf | Prohibited | C | 1402 | Comprehensive Categorization: Encryption |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-296 | Windows(os class) Weaknesses |
| MemberOf | Prohibited | BS | BOSS-323 | Read Memory (impact) |
| MemberOf | Prohibited | BS | BOSS-328 | Read Application Data (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1013 | Encrypt Data |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 963 | SFP Secondary Cluster: Exposed Data |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Confidentiality | N/A | Read MemoryRead Application Data | N/A |
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
| Reference | Description |
|---|---|
| CVE-2002-1848 | Unencrypted passwords stored in GUI dialog may allow local users to access the passwords. |
| Ordinality | Description |
|---|
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption. However, within cryptography, these have more precise meanings. Plaintext is the information just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is any information that is unencrypted, although it might be in an encoded form that is not easily human-readable (such as base64 encoding).
N/A
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| PLOVER | N/A | N/A | Plaintext Storage in GUI |
| Software Fault Patterns | SFP23 | N/A | Exposed Data |
| ID | Name |
|---|