CWE WEAKNESSES / CWE-257
CWE-257
Storing Passwords in a Recoverable Format
Base EXPLOIT LIKELIHOOD: HIGH
What it is
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
Impact
| Confidentiality, Access Control | Gain Privileges or Assume Identity |
| Access Control | Gain Privileges or Assume Identity |
Mitigations
- [Architecture and Design] Use strong, non-reversible encryption to protect stored passwords.
Real-world CVE examples
- CVE-2022-30018 — A messaging platform serializes all elements of User/Group objects, making private information available to adversaries
Related weaknesses
Test & detect
Browse all common weaknesses, check related exploited CVEs, or map to ATT&CK techniques.
Source: MITRE CWE. View on cwe.mitre.org →