CWE-317: Cleartext Storage of Sensitive Information in GUI

Variant Draft Simple

CWE版本: 4.18

更新日期: 2025-09-09

弱点描述

The product stores sensitive information in cleartext within the GUI.

扩展描述

An attacker can often obtain data from a GUI, even if hidden, by using an API to directly access GUI objects such as windows and menus. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

常见后果

影响范围: Confidentiality

技术影响: Read Memory Read Application Data

观察示例

参考: CVE-2002-1848

Unencrypted passwords stored in GUI dialog may allow local users to access the passwords.

引入模式

阶段	说明
Architecture and Design	OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

适用平台

编程语言

Not Language-Specific (Undetermined)

操作系统

Windows (Sometimes)

分类映射

分类名称	条目ID	条目名称	映射适配度
PLOVER	-	Plaintext Storage in GUI	-
Software Fault Patterns	SFP23	Exposed Data	-

关键信息

CWE ID: CWE-317

抽象级别: Variant

结构: Simple

状态: Draft