CWE-13
ASP.NET Misconfiguration: Password in Configuration File
AI Translation Available
Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.
Status
draft
Abstraction
variant
Affected Platforms
ASP.NET
Technical Details
AI Translation
Common Consequences
access control
Impacts
gain privileges or assume identity
Potential Mitigations
Phases:
implementation
Descriptions:
•
Credentials stored in configuration files should be encrypted, Use standard APIs and industry accepted algorithms to encrypt the credentials stored in configuration files.