CWE-522Insufficiently Protected Credentials

Description

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Common consequences

• Access Control→Gain Privileges or Assume Identity
  An attacker could gain access to user accounts and access sensitive data used by the user accounts.

Potential mitigations

• Architecture and Design
  Use an appropriate security mechanism to protect the credentials.
• Architecture and Design
  Make appropriate use of cryptography to protect the credentials.
• Implementation
  Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Related CWEs

Recent CVEs classified under this CWE