CWE-522: Insufficiently Protected Credentials

MITRE CWE weakness

Description

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Common consequences

• Access Control: Gain Privileges or Assume Identity

Mitigations

Architecture and Design — Use an appropriate security mechanism to protect the credentials.

Architecture and Design — Make appropriate use of cryptography to protect the credentials.

Implementation — Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

References

• CWE page: https://cwe.mitre.org/data/definitions/522.html
• CWE list: https://cwe.mitre.org/data/index.html