Falhas do tipo CWE-259

195 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2023-5222MEDIUMViessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded passwordEPSS 74.5%CVE-2024-7332CRITICALTOTOLINK CP450 Telnet Service product.ini hard-coded passwordEPSS 20.7%CVE-2012-5862—Sinapsi eSolar Hard-Coded PasswordEPSS 11.9%CVE-2023-51629MEDIUMD-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass VulnerabilityEPSS 3.9%CVE-2025-8730CRITICALBelkin F9K1009/F9K1010 Web Interface hard-coded credentialsEPSS 3.2%CVE-2023-2645CRITICALUSR USR-G806 Web Management Page hard-coded passwordEPSS 3.2%CVE-2025-57788MEDIUMUnauthorized API Access RiskEPSS 2.8%CVE-2014-5405—Hospira MedNet Use of Hard-coded PasswordEPSS 2.3%CVE-2016-9358—A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A32EPSS 2.1%CVE-2014-2363—Morpho Itemiser 3 Hard-Coded CredentialEPSS 2.1%CVE-2015-3953—Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and EPSS 2.0%CVE-2020-12016—Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,EPSS 1.9%CVE-2019-3908—Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An aEPSS 1.8%CVE-2021-22729—A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink PEPSS 1.8%CVE-2017-6022—A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA JourEPSS 1.8%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-21818HIGHA hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted netEPSS 1.7%CVE-2020-12047—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-defaEPSS 1.7%CVE-2020-12045—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), opEPSS 1.7%CVE-2014-5434—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account withEPSS 1.6%