Weaknesses of type CWE-257

67 results

Armazenamento de senhas em formato recuperável

A aplicação guarda senhas de forma que podem ser recuperadas em texto plano ou descriptografadas facilmente (como encriptação reversível ou hash sem salt). Isso viola o princípio de que senhas nunca devem ser recuperáveis: um atacante que comprometa o banco de dados consegue usar as senhas imediatamente.

Example

Um sistema de e-commerce armazena senhas encriptadas com AES usando uma chave fixa no código. Quando alguém faz SQL injection ou rouba o backup do banco, consegue descriptografar todas as senhas porque a chave está exposta no repositório Git.

How to mitigate

Use funções de hash com salt (bcrypt, scrypt, Argon2) — não encriptação reversível. Valide que as senhas não são recuperáveis nem em backups, e revise regularmente como credenciais são armazenadas. Se guardar senhas de terceiros, use padrões como OAuth em vez de armazená-las.

CVE-2022-46142MEDIUMAffected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the filEPSS 0.3%CVE-2023-2358MEDIUMHitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format EPSS 0.2%CVE-2024-45744LOWTopQuadrant TopBraid EDG password manager stores external credentials insecurelyEPSS 0.2%CVE-2024-32122LOWA storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, ForEPSS 0.2%CVE-2025-8095CRITICALRecoverable obfuscation using the OECH1 prefix encoding in OpenEdgeEPSS 0.2%CVE-2016-15058HIGHHirschmann HiLCOS Classic Platform Password Exposure via SNMPEPSS 0.2%CVE-2023-31001MEDIUMIBM Security Access Manager Container information disclosureEPSS 0.2%CVE-2025-27459MEDIUMCVE-2025-27459EPSS 0.2%CVE-2025-6995HIGHImproper Encryption in Ivanti Endpoint ManagerEPSS 0.2%CVE-2025-6996HIGHImproper Encryption in Ivanti Endpoint ManagerEPSS 0.2%CVE-2025-57796MEDIUMUse of a hardcoded static key to protect sensitive data in Explorance BlueEPSS 0.2%CVE-2025-34180HIGHNetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential RecoveryEPSS 0.2%CVE-2025-14295HIGHAutomated Logic WebCTRL and Carrier i-Vu Session FixationEPSS 0.2%CVE-2022-47376HIGHThe Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health daEPSS 0.2%CVE-2022-22251HIGHcSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privilegesEPSS 0.2%CVE-2024-20462MEDIUMCisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure VulnerabilityEPSS 0.2%CVE-2026-65309HIGHStorage of passwords in a reversible formatEPSS 0.2%CVE-2022-34838HIGHABB Ability TM Operations Data Management Zenon Zenon Log Server file access controlEPSS 0.2%CVE-2022-34837MEDIUMABB Ability TM Operations Data Management Zenon Zenon Log Server file access controlEPSS 0.1%CVE-2025-40774MEDIUMA vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted EPSS 0.1%