CWE-319 Base Draft High likelihood

Cleartext Transmission of Sensitive Information

This vulnerability occurs when an application sends sensitive data, such as passwords or personal information, over a network connection without using encryption. Attackers can easily intercept and…

Definition

What is CWE-319?

When data is transmitted in cleartext, it's like sending a postcard instead of a sealed letter—anyone handling it can read the contents. This is a fundamental security failure because modern networks, especially public Wi-Fi, are shared environments where attackers use simple 'sniffing' tools to capture traffic. Sensitive information like login credentials, session tokens, financial details, or personal data should never be exposed this way. The solution is to always use strong encryption for all communication channels. This means enforcing HTTPS (TLS/SSL) for web traffic and encrypted protocols like SSH or VPNs for other connections. Developers should implement encryption by default, avoid mixed content (HTTP within HTTPS pages), and use security headers like HTTP Strict Transport Security (HSTS) to prevent accidental cleartext transmission.

Vulnerability Diagram CWE-319

Auswirkungen in der Praxis

Real-world CVEs caused by CWE-319

CVE-2022-29519

Programmable Logic Controller (PLC) sends sensitive information in plaintext, including passwords and session tokens.
CVE-2022-30312

Building Controller uses a protocol that transmits authentication credentials in plaintext.
CVE-2022-31204

Programmable Logic Controller (PLC) sends password in plaintext.
CVE-2002-1949

Passwords transmitted in cleartext.
CVE-2008-4122

Chain: Use of HTTPS cookie without "secure" flag causes it to be transmitted across unencrypted HTTP.
CVE-2008-3289

Product sends password hash in cleartext in violation of intended policy.
CVE-2008-4390

Remote management feature sends sensitive information including passwords in cleartext.
CVE-2007-5626

Backup routine sends password in cleartext in email.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

1
The following code attempts to establish a connection to a site to communicate sensitive information.
2
Though a connection is successfully made, the connection is unencrypted and it is possible that all sensitive data sent to or received from the server will be read by unintended actors.
3
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
4
Multiple vendors used cleartext transmission of sensitive information in their OT products.
5
A TAP accessible register is read/written by a JTAG based tool, for internal use by authorized users. However, an adversary can connect a probing device and collect the values from the unencrypted channel connecting the JTAG interface to the authorized user, if no additional protections are employed.

Verwundbares Codebeispiel

Vulnerable Java

The following code attempts to establish a connection to a site to communicate sensitive information.

Verwundbar Java

try {
  	URL u = new URL("http://www.secret.example.org/");
  	HttpURLConnection hu = (HttpURLConnection) u.openConnection();
  	hu.setRequestMethod("PUT");
  	hu.connect();
  	OutputStream os = hu.getOutputStream();
  	hu.disconnect();
  }
  catch (IOException e) {
```
//...* 
  	}

Sicheres Codebeispiel

Secure Shell

Azure's storage accounts can be configured to only accept requests from secure connections made over HTTPS. The secure transfer setting can be enabled using Azure's Portal (GUI) or programmatically by setting the enableHttpsTrafficOnly property to True on the storage account, such as:

Sicher Shell

az storage account update -g {ResourceGroupName} -n {StorageAccountName} --https-only true

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Präventions-Checkliste

How to prevent CWE-319

Architecture and Design Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
Implementation When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
Implementation When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
Testing Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Operation Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.

Erkennungssignale

How to detect CWE-319

Black Box

Use monitoring tools that examine the software's process as it interacts with the operating system and the network. This technique is useful in cases when source code is unavailable, if the software was not developed by you, or if you want to verify that the build phase did not introduce any new weaknesses. Examples include debuggers that directly attach to the running process; system-call tracing utilities such as truss (Solaris) and strace (Linux); system activity monitors such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities (Windows); and sniffers and protocol analyzers that monitor network traffic. Attach the monitor to the process, trigger the feature that sends the data, and look for the presence or absence of common cryptographic functions in the call tree. Monitor the network and determine if the data packets contain readable commands. Tools exist for detecting if certain encodings are in use. If the traffic contains high entropy, this might indicate the usage of encryption.

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Plexicus Auto-Fix

Plexicus erkennt CWE-319 automatisch und öffnet in unter 60 Sekunden einen Fix-PR.

Codex Remedium scannt jeden Commit, identifiziert genau diese Schwachstelle und liefert einen reviewer-ready Pull Request mit dem Patch. Keine Tickets. Keine Hand-offs.

Demo anfordern Plexicus kostenlos testen

Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-319?

Wie gravierend ist CWE-319?

MITRE stuft die Exploit-Wahrscheinlichkeit als hoch ein — diese Schwachstelle wird aktiv in freier Wildbahn ausgenutzt und sollte priorisiert behoben werden.

Welche Sprachen oder Plattformen sind von CWE-319 betroffen?

MITRE lists the following affected platforms: Cloud Computing, Mobile, ICS/OT, System on Chip, Test/Debug Hardware.

Wie kann ich CWE-319 verhindern?

Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols. When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.

Wie erkennt und behebt Plexicus CWE-319?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-319 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-319?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/319.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-319

CWE-311 Parent

Missing Encryption of Sensitive Data

This vulnerability occurs when an application stores or sends sensitive information without first encrypting it, leaving the data exposed.

CWE-312 Sibling

Cleartext Storage of Sensitive Information

This vulnerability occurs when an application stores sensitive data like passwords, credit card numbers, or personal information in plain…

CWE-1428 Child

Reliance on HTTP instead of HTTPS

This vulnerability occurs when an application uses unencrypted HTTP connections instead of the secure HTTPS alternative, even when HTTPS…

CWE-5 Child

J2EE Misconfiguration: Data Transmission Without Encryption

This vulnerability occurs when a J2EE application transmits sensitive data, like login credentials or session tokens, across a network…

CWE-614 Child

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

This vulnerability occurs when a web application transmits sensitive cookies over an HTTPS connection but fails to set the 'Secure'…

Ressourcen

Schluss mit dem Bezahlen pro Entwickler.
Schließ den Kreislauf.

Plexicus ist die KI-native ASPM, die scannt, filtert, fixt, pentestet und erklärt — autonom. Unbegrenzte Entwickler, unbegrenzte Repos, Fair-Use-KI-Aktionen. Echter kostenloser Tarif, €269/mo jährlich, wenn du bereit bist.

Kostenlos starten Demo buchen