Storing sensitive data in plaintext within the GUI makes the data more easily accessible than if encrypted. This significantly lowers the difficulty of exploitation by attackers.
Extended Description
An attacker can often obtain data from a GUI, even if hidden, by using an API to directly access GUI objects such as windows and menus.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Operating Systems
Windows: (Sometimes)
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read memory; Read application
data
Unencrypted passwords stored in GUI dialog may
allow local users to access the passwords.
Potential Mitigations
Sensitive information should not be stored in plaintext in a GUI. Even
if heavy fortifications are in place, sensitive data should be encrypted
to prevent the risk of losing confidentiality.
Description
