CWE-312 Cleartext Storage of Sensitive Information

Coverage: 7 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 7 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged sensitive information being stored in plaintext (database fields, config files, caches, exports, or local files) without appropriate protection.

Why it matters

Cleartext data can be exposed in breaches or logs.

• Breach impact increases because attackers don't need to decrypt anything.
• Operational leakage: plaintext secrets often end up in backups, dumps, and support artifacts.
• Hard to rotate: once plaintext secrets spread, cleanup is painful.

Safer examples

1) Store secrets in a secret manager (not in the DB)

Prefer managed secret storage and short-lived tokens when possible.

2) If you must store sensitive values, encrypt at rest properly

Use authenticated encryption with a managed key (KMS/HSM) and strict access controls.

3) Reduce what you store

Store hashes/tokens/ids instead of raw sensitive values when feasible.

How SiteShadow detects it (high level)

• Flags persistence of sensitive-looking fields (tokens/passwords/keys/PII) without signs of hashing/encryption.
• Detects "store to disk/db" operations where plaintext sensitive values appear.

References

• CWE-312: https://cwe.mitre.org/data/definitions/312.html

---

← Back to Vulnerability Library