CWE-522: Insufficiently Protected Credentials
Description
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Access Control
Gain Privileges or Assume Identity
An attacker could gain access to user accounts and access sensitive data used by the user accounts.
Potential mitigations
- Architecture and Design
Use an appropriate security mechanism to protect the credentials.
- Architecture and Design
Make appropriate use of cryptography to protect the credentials.
- Implementation
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
Related weaknesses
CAPEC attack patterns that exploit it
- CAPEC-50Password Recovery Exploitation
- CAPEC-102Session Sidejacking
- CAPEC-474Signature Spoofing by Key Theft
- CAPEC-509Kerberoasting
- CAPEC-551Modify Existing Service
- CAPEC-555Remote Services with Stolen Credentials
- CAPEC-560Use of Known Domain Credentials
- CAPEC-561Windows Admin Shares with Stolen Credentials
- CAPEC-600Credential Stuffing
- CAPEC-644Use of Captured Hashes (Pass The Hash)
- CAPEC-645Use of Captured Tickets (Pass The Ticket)
- CAPEC-652Use of Known Kerberos Credentials
- CAPEC-653Use of Known Operating System Credentials