J2EE Misconfiguration: Plaintext Password in Configuration File

This misconfiguration occurs when a developer writes a password directly into a configuration file (like XML or .properties) without any encryption. Since these files are often needed for the application to start, they are frequently readable by other processes or users on the system, exposing the credential in clear text. Anyone with access to this file, such as a system administrator, a different application on the same server, or an attacker who gains a foothold, can immediately read and use the password. This bypasses all security controls for the protected resource, such as a database, making it a trivial target for compromise.