CWE一覧に戻る
CWE-256

パスワードの平文保存

Plaintext Storage of a Password
脆弱性 作成中
JA

この製品は、パスワードをメモリやファイルなどのリソース内に平文で保存する。

EN

The product stores a password in plaintext within resources such as memory or files.

Scope: Access Control / Impact: Gain Privileges or Assume Identity
Avoid storing passwords in easily accessible locations.
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
MITRE公式ページ — CWE-256