CWE-522
Insufficiently Protected Credentials
AI Translation Available
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Status
incomplete
Abstraction
class
Affected Platforms
ICS/OT
Not Technology-Specific
Web Based
Technical Details
AI Translation
Common Consequences
access control
Impacts
gain privileges or assume identity
Detection Methods
automated static analysis
Potential Mitigations
Phases:
architecture and design
implementation
Descriptions:
•
Use an appropriate security mechanism to protect the credentials.
•
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
•
Make appropriate use of cryptography to protect the credentials.