Cleartext Transmission of Sensitive Information
This vulnerability occurs when an application sends sensitive data, such as passwords or personal information, over a network connection without using encryption. Attackers can easily intercept and read this unprotected data as it travels.
When data is transmitted in cleartext, it's like sending a postcard instead of a sealed letter—anyone handling it can read the contents. This is a fundamental security failure because modern networks, especially public Wi-Fi, are shared environments where attackers use simple 'sniffing' tools to capture traffic. Sensitive information like login credentials, session tokens, financial details, or personal data should never be exposed this way. The solution is to always use strong encryption for all communication channels. This means enforcing HTTPS (TLS/SSL) for web traffic and encrypted protocols like SSH or VPNs for other connections. Developers should implement encryption by default, avoid mixed content (HTTP within HTTPS pages), and use security headers like HTTP Strict Transport Security (HSTS) to prevent accidental cleartext transmission.
Impact: Read Application DataModify Files or Directories
Anyone can read the information by gaining access to the channel being used for communication. Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination, whether across the internet, an internal network, the cloud, etc. Some actors might have privileged access to a network interface or any link along the channel, such as a router, but they might not be authorized to collect the underlying data. As a result, network traffic could be sniffed by adversaries, spilling security-critical data.
Impact: Read Application DataModify Files or DirectoriesOther
When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
ID : DX-42
The following code attempts to establish a connection to a site to communicate sensitive information.Code Example:
java//...* }
ID : DX-153
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.Code Example:
shellCode Example:
jsonCode Example:
shellCode Example:
jsonHigh
- PLOVER
- The CERT Oracle Secure Coding Standard for Java (2011)
- The CERT Oracle Secure Coding Standard for Java (2011)
- Software Fault Patterns
- ISA/IEC 62443
- ISA/IEC 62443