CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File
J2EE Misconfiguration: Plaintext Password in Configuration File
Weakness ID: 555 (Weakness Variant)
Status: Draft
Description
Description Summary
The J2EE application stores a plaintext password in a
configuration file.
Extended Description
Storing a plaintext password in a configuration file allows anyone who can
read the file access to the password-protected resource making them an easy
target for attackers
Time of Introduction
Architecture and Design
Implementation
Demonstrative Examples
Example 1
Below is a snippet from a Java properties file in which the LDAP
server password is stored in plaintext.
(Bad Code)
Java
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
Potential Mitigations
Phase
Description
Do not hardwire passwords into your software.
Good password management guidelines require that a password never be
stored in plaintext.
Use industry standard libraries to encrypt passwords before storage in
configuration files.
Description
