Password in Configuration File
CWE-260
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.1.
How this weakness is prevented
- Architecture and Design: Avoid storing passwords in easily accessible locations.
- Architecture and Design: Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Latest Password in Configuration File vulnerabilities
- 7.5 High severity
MiniDVBLinux(TM) Distribution (MLD): Password in Configuration File
MiniDVBLinux 5.4 contains an unauthenticated configuration download vulnerability that allows remote attackers to access sensitive system configuration files through a direct object reference. Attackers can exploit the backup download endpoint by sending a GET
- 9.9 Critical severity
Tinycontrol LAN Controller v: Password in Configuration File
Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-
- 9.8 Critical severity
eslint-ban-moment: Password in Configuration File
eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over
- 8.8 High severity
QRadar Suite Software: Password in Configuration File
IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files.
- 8.7 High severity
acme.sh: Password in Configuration File
The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.
- 9.8 Critical severity
GMS: Insufficiently Protected Credentials
Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.