CWE-319 Cleartext Transmission of Sensitive Information

Coverage: 12 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 9Other-pattern 3 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged sensitive data being sent over an insecure channel (no TLS/HTTPS) or sent in a way that leaks in transit (e.g., query strings, mixed content).

Why it matters

Attackers can intercept credentials or tokens in transit.

• Token/session theft over shared networks or compromised routers.
• Credential compromise when passwords/API keys travel unencrypted.
• Content tampering: attackers can modify responses to inject malicious behavior.

Safer examples

1) Use HTTPS everywhere

• Redirect HTTP → HTTPS
• Enable HSTS

2) Never put secrets in URLs

Avoid tokens/passwords in query strings (they leak into logs and referrers). Use headers or POST bodies where appropriate.

3) Keep TLS verification enabled

Don't disable certificate checks to "make it work" (see T01 / CWE-295).

How SiteShadow detects it (high level)

• Flags use of http:// endpoints for sensitive operations and mixed-content patterns.
• Detects credential-like data being placed into URLs or transmitted without secure transport settings.

References

• CWE-319: https://cwe.mitre.org/data/definitions/319.html

---

← Back to Vulnerability Library