CWE-312 804 CVEs MITRE definition ↗

CWE-312: Cleartext Storage of Sensitive Information

Overview

CWE-312 (Cleartext Storage of Sensitive Information) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Applicable platforms

Kind Name Class Prevalence OS / CPE
language Not Language-Specific Undetermined
technology Cloud Computing Undetermined
technology ICS/OT Undetermined
technology Mobile Undetermined

Related CVEs in this database

These CVEs are mapped to this weakness in this database and kept for traceability and search.

CVE Published Summary
CVE-2026-46622 2026-06-11 SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any …
CVE-2026-10786 2026-06-08 Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations vi…
CVE-2026-36176 2026-06-04 GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. This allows physically-proximate attackers to extract these active token…
CVE-2026-4387 2026-05-29 StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a …
CVE-2026-45040 2026-05-28 RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server is run with RUST_LOG=debug sensiti…
CVE-2026-9274 2026-05-25 This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory. An attacker with physical access could exploit this vulnerability by accessing …
CVE-2026-8596 2026-05-14 Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract t…
CVE-2026-6332 2026-05-14 CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of c…
CVE-2026-42408 2026-05-13 When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information.  Note: Softw…
CVE-2026-28758 2026-05-13 When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also…
CVE-2026-43992 2026-05-12 JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepte…
CVE-2026-45362 2026-05-12 Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
CVE-2026-41520 2026-05-08 Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when t…
CVE-2026-43942 2026-05-08 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire …
CVE-2026-8026 2026-05-06 A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Respon…
CVE-2026-42151 2026-05-04 Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/az…
CVE-2026-7163 2026-04-30 A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scop…
CVE-2026-41385 2026-04-28 OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted c…
CVE-2026-6796 2026-04-21 A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d. Affected is the function log_login of the file core/src/main/java/com/publiccms/controller/admin/LoginAdminController.java of the …
CVE-2026-6553 2026-04-21 Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS…

Previous names

  • Plaintext Storage of Sensitive Information (2009-01-12)

Content submission

Name
PLOVER
Date
2006-07-19
Version
Draft 3

Content modifications

Date Name Version Importance Comment
2008-07-01 Eric Dalci 1.0 updated Time_of_Introduction
2008-09-08 CWE Content Team 1.0 updated Relationships, Taxonomy_Mappings
2009-01-12 CWE Content Team 1.2 updated Description, Name
2010-02-16 CWE Content Team 1.8 updated References
2010-06-21 CWE Content Team 1.9 updated Relationships
2011-06-01 CWE Content Team 1.13 updated Common_Consequences
2012-05-11 CWE Content Team 2.2 updated Common_Consequences, Demonstrative_Examples, Observed_Examples, References, Related_Attack_Patterns, Relationships
2013-02-21 CWE Content Team 2.4 updated Applicable_Platforms, References
2013-07-17 CWE Content Team 2.5 updated Description, Relationships, Terminology_Notes
2014-07-30 CWE Content Team 2.8 updated Demonstrative_Examples, Relationships, Taxonomy_Mappings
2017-05-03 CWE Content Team 2.11 updated Related_Attack_Patterns
2017-11-08 CWE Content Team 3.0 updated Modes_of_Introduction, References, Relationships
2018-01-23 CWE Content Team 3.1 updated Abstraction, Relationships
2018-03-27 CWE Content Team 3.1 updated References, Relationships, Type
2019-06-20 CWE Content Team 3.3 updated Relationships, Type
2020-02-24 CWE Content Team 4.0 updated Applicable_Platforms, Relationships
2021-03-15 CWE Content Team 4.4 updated Demonstrative_Examples
2021-10-28 CWE Content Team 4.6 updated Relationships
2022-10-13 CWE Content Team 4.9 updated Applicable_Platforms, Demonstrative_Examples, Description, Observed_Examples, Potential_Mitigations, References
2023-01-31 CWE Content Team 4.10 updated Applicable_Platforms, Demonstrative_Examples, Description, References, Relationships
2023-04-27 CWE Content Team 4.11 updated Detection_Factors, References, Relationships, Taxonomy_Mappings
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes, Relationships
2024-02-29 CWE Content Team 4.14 updated Taxonomy_Mappings
2025-04-03 CWE Content Team 4.17 updated Common_Consequences, Description, Diagram, Other_Notes, Potential_Mitigations
2025-12-11 CWE Content Team 4.19 updated Observed_Examples, Relationships, Weakness_Ordinalities

Contributions

Type Name Date Comment
Content "Mapping CWE to 62443" Sub-Working Group 2023-04-25 Suggested mappings to ISA/IEC 62443.
cvelogic Threat Intelligence