CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File
Description
The J2EE application stores a plaintext password in a configuration file.
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resource, making it an easy target for attackers.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access Control
Bypass Protection Mechanism
Potential mitigations
- Architecture and Design
Do not hardwire passwords into your software.
- Architecture and Design
Use industry standard libraries to encrypt passwords before storage in configuration files.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.