CWE-312 Cleartext Storage of Sensitive Information
What this means
SiteShadow flagged sensitive information being stored in plaintext (database fields, config files, caches, exports, or local files) without appropriate protection.
Why it matters
Cleartext data can be exposed in breaches or logs.
- Breach impact increases because attackers don't need to decrypt anything.
- Operational leakage: plaintext secrets often end up in backups, dumps, and support artifacts.
- Hard to rotate: once plaintext secrets spread, cleanup is painful.
Safer examples
1) Store secrets in a secret manager (not in the DB)
Prefer managed secret storage and short-lived tokens when possible.
2) If you must store sensitive values, encrypt at rest properly
Use authenticated encryption with a managed key (KMS/HSM) and strict access controls.
3) Reduce what you store
Store hashes/tokens/ids instead of raw sensitive values when feasible.
How SiteShadow detects it (high level)
- Flags persistence of sensitive-looking fields (tokens/passwords/keys/PII) without signs of hashing/encryption.
- Detects "store to disk/db" operations where plaintext sensitive values appear.
References
- CWE-312: https://cwe.mitre.org/data/definitions/312.html
---