CWE-260

Password in Configuration File

High

Description

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

Potential Impact

How to Fix

Architecture and Design

Avoid storing passwords in easily accessible locations.

Architecture and Design

Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-260 vulnerabilities in your codebase.

Get Security Assessment