|
|
|
|
CWE-260 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Incomplete 260 (Weakness Variant) | | Description | Summary Storing a password in a configuration file may result in system compromise. An attacker
could gain access to this file and learn the stored password or worse yet, change the password to
one of their choosing. | | Affected Resource | File/Directory | | Potential Mitigations | Avoid storing passwords in easily accessible locations. Consider storing cryptographic hashes of passwords as an alternative to storing in
plaintext. | | References | J. Viega and G. McGraw.
"Building Secure Software: How to Avoid Security Problems the Right Way". 2002. | | Relationships | | | Source Taxonomies | 7 Pernicious Kingdoms - Password Management: Password in Configuration File | | Applicable Platforms | All |
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
