目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-256 明文存储口令 类漏洞列表 187

CWE-256 明文存储口令 类弱点 187 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-256 指产品将密码以明文形式存储在内存或文件等资源中，属于数据保护不当类漏洞。攻击者若获取系统访问权限，可直接读取存储介质中的明文密码，进而冒充合法用户进行未授权访问或横向移动。开发者应避免直接存储明文，转而采用加盐哈希算法对密码进行不可逆处理，并确保密钥管理安全，从而有效防止凭据泄露风险。

MITRE CWE 官方描述
CWE：CWE-256 Plaintext Storage of a Password 英文：The product stores a password in plaintext within resources such as memory or files.
常见影响 (1)
Access Control Gain Privileges or Assume Identity
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resource. In some contexts, even storage of a plaintext password in memory is considered a security risk if the password is not cleared immediately after it is used.
缓解措施 (3)
Architecture and Design Avoid storing passwords in easily accessible locations.
Architecture and Design Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Effectiveness: None
代码示例 (2)
The following code reads a password from a properties file and uses the password to connect to a database.
... Properties prop = new Properties(); prop.load(new FileInputStream("config.properties")); String password = prop.getProperty("password"); DriverManager.getConnection(url, usr, password); ...
Bad · Java
The following code reads a password from the registry and uses the password to create a new network credential.
... String password = regKey.GetValue(passKey).toString(); NetworkCredential netCred = new NetworkCredential(username,password,domain); ...
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2017-6049 Detcon SiteWatch Gateway 授权问题漏洞 — Sitewatch Gateway 5.3 - 2019-04-02
CVE-2019-6518 多款Moxa产品信息泄露漏洞 — Moxa IKS, EDS 7.5 - 2019-03-05
CVE-2017-16714 Ice Qube Thermal Management Center 安全漏洞 — Thermal Management Center 9.8 - 2018-09-06
CVE-2018-8851 多款Echelon产品安全漏洞 — SmartServer 1 9.8 - 2018-07-24
CVE-2018-7510 BeaconMedaes TotalAlert Scroll Medical Air Systems Web应用程序安全漏洞 — BeaconMedaes TotalAlert Scroll Medical Air Systems web application 9.8 - 2018-06-06
CVE-2018-7515 Omron CX-Supervisor 缓冲区错误漏洞 — BeaconMedæs TotalAlert Scroll Medical Air Systems web application 5.3 - 2018-03-21
CVE-2017-7913 多款摩莎产品安全漏洞 — Moxa OnCell 9.8 - 2017-05-29

CWE-256（明文存储口令） 是常见的弱点类别，本平台收录该类弱点关联的 187 条 CVE 漏洞。