Falhas do tipo CWE-260
24 resultadosSenha armazenada em arquivo de configuração
A aplicação grava credenciais (senhas, tokens, chaves) em arquivos de configuração em texto plano ou com criptografia fraca. Qualquer pessoa com acesso ao servidor ou repositório de código consegue ler a senha diretamente, comprometendo contas e serviços.
Exemplo
Um arquivo config.properties com 'db.password=senha123' commitado no repositório Git, ou um arquivo .env exposto no servidor web. Um atacante clona o repo ou faz acesso ao servidor e obtém credenciais de banco de dados.
Como mitigar
Use gerenciadores de segredos (Vault, AWS Secrets Manager, Azure Key Vault) ou variáveis de ambiente. Nunca commite credenciais em código; implemente .gitignore, rotação automática de chaves, e escaneie repositórios com ferramentas como git-secrets ou TruffleHog.
CVE-2017-7925—A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IEPSS 51.4%CVE-2017-7923—A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xEPSS 2.3%CVE-2016-7043MEDIUMIt has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properEPSS 1.5%CVE-2019-3780CRITICALCloud Foundry Container Runtime Leaks IAAS CredentialsEPSS 1.4%CVE-2023-34128—Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlieEPSS 0.7%CVE-2023-53739CRITICALTinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup DisclosureEPSS 0.6%CVE-2023-53770HIGHMiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup EndpointEPSS 0.5%CVE-2019-25465HIGHHisilicon HiIpcam V100R003 Information Disclosure via Directory TraversalEPSS 0.5%CVE-2021-35033HIGHA vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managemEPSS 0.4%CVE-2020-5721—MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field EPSS 0.4%CVE-2025-32111HIGHThe Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for EPSS 0.4%CVE-2025-57754CRITICALeslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)EPSS 0.4%CVE-2014-5400—Hospira MedNet Password in Configuration FileEPSS 0.3%CVE-2025-33093HIGHIBM Sterling Partner Engagement Manager information disclosureEPSS 0.3%CVE-2025-25022CRITICALIBM QRadar Suite Software and IBM Cloud Pak for Security information disclosureEPSS 0.3%CVE-2025-15151MEDIUMTaleLin Lin-CMS Tests Folder config.py password in configuration fileEPSS 0.3%CVE-2023-2790LOWTOTOLINK N200RE Telnet Service custom.conf password in configuration fileEPSS 0.3%CVE-2025-51540MEDIUMEzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and aEPSS 0.2%CVE-2025-33119MEDIUMIBM QRadar SIEM Information DisclosureEPSS 0.2%CVE-2024-49817MEDIUMIBM Security Guardium Key Lifecycle Manager information disclosureEPSS 0.2%