63 vulnerabilities classified as CWE-257 (以可恢复格式存储口令). AI Chinese analysis included.
CWE-257 represents a critical data storage weakness where passwords are kept in a recoverable format, such as reversible encryption or plaintext, rather than using one-way cryptographic hashing. This flaw is typically exploited by malicious insiders or attackers who gain access to the database, allowing them to decrypt stored credentials and engage in password reuse attacks across multiple systems. Because the original passwords can be retrieved, this practice offers no security advantage over storing them in plain text and significantly increases the blast radius of a breach. To avoid this vulnerability, developers must implement strong, salted hashing algorithms like bcrypt or Argon2, ensuring that passwords are irreversibly transformed and cannot be recovered even if the storage medium is compromised.
int VerifyAdmin(char *password) { if (strcmp(compress(password), compressed_password)) { printf("Incorrect Password!\n"); return(0); } printf("Entering Diagnostic Mode...\n"); return(1); }int VerifyAdmin(String password) { if (passwd.Equals(compress(password), compressed_password)) { return(0); } //Diagnostic Mode return(1); }# Java Web App ResourceBundle properties file ... webapp.ldap.username=secretUsername webapp.ldap.password=secretPassword ...... <connectionStrings> <add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" /> </connectionStrings> ...Vulnerabilities classified as CWE-257 (以可恢复格式存储口令) represent 63 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.