Cleartext Storage in the Registry

Opis

The product stores sensitive information in cleartext in the registry.

Attackers can read the information by accessing the registry key. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Skutki

• Confidentiality

  Read Application Data

Przykłady podatności

• CVE-2005-2227 Cleartext passwords in registry key.

Słabość nadrzędna

• CWE-312 Cleartext Storage of Sensitive Information

Kiedy powstaje

• Architecture and Design — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Dotyczy

Not Language-Specific

Uwagi

Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption. However, within cryptography, these have more precise meanings. Plaintext is the information just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is any information that is unencrypted, although it might be in an encoded form that is not easily human-readable (such as base64 encoding).