目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-319 敏感数据的明文传输 类漏洞列表 453

CWE-319 敏感数据的明文传输 类弱点 453 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-319 指敏感信息在通信过程中以明文形式传输，易被网络嗅探。攻击者通常利用中间人攻击或公共 Wi-Fi 环境截获数据，窃取凭证或隐私。开发者应避免使用 HTTP 等未加密协议，强制实施 TLS/SSL 加密传输，并对关键数据进行端到端加密，确保即使数据被拦截也无法被解读，从而保障通信安全。

MITRE CWE 官方描述
CWE：CWE-319 敏感信息明文传输 英文：产品在通信通道中以明文形式传输敏感或安全关键数据，该通道可被未授权方嗅探。
常见影响 (2)
Integrity, Confidentiality Read Application Data, Modify Files or Directories
Anyone can read the information by gaining access to the channel being used for communication. Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination…
Integrity, Confidentiality Read Application Data, Modify Files or Directories, Other
When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that i…
缓解措施 (5)
Architecture and Design Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
Implementation When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
Implementation When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
Testing Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Operation Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
代码示例 (2)
The following code attempts to establish a connection to a site to communicate sensitive information.
try { URL u = new URL("http://www.secret.example.org/"); HttpURLConnection hu = (HttpURLConnection) u.openConnection(); hu.setRequestMethod("PUT"); hu.connect(); OutputStream os = hu.getOutputStream(); hu.disconnect(); } catch (IOException e) { //... }
Bad · Java
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID 标题 CVSS 风险等级 Published
CVE-2017-9637 Schneider Electric Ampla MES 安全漏洞 — Ampla MES 5.9 - 2018-05-18
CVE-2018-5471 多款Belden产品安全漏洞 — Hirschmann Automation and Control GmbH Classic Platform Switches 5.9 - 2018-03-06
CVE-2017-8444 Elastic Cloud Enterprise 安全漏洞 — Elastic Cloud Enterprise 5.9 - 2017-09-28

CWE-319（敏感数据的明文传输） 是常见的弱点类别，本平台收录该类弱点关联的 453 条 CVE 漏洞。