Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-311 (敏感数据加密缺失) — Vulnerability Class 257

257 vulnerabilities classified as CWE-311 (敏感数据加密缺失). AI Chinese analysis included.

CWE-311 represents a critical data protection weakness where software fails to encrypt sensitive information before storage or transmission, leaving confidential data exposed in plaintext. Attackers typically exploit this vulnerability by intercepting network traffic through man-in-the-middle attacks or by gaining unauthorized physical or logical access to storage systems, allowing them to read credentials, financial records, or personal identifiable information without obstruction. To mitigate this risk, developers must implement robust cryptographic standards, such as AES-256 for data at rest and TLS 1.3 for data in transit, ensuring that all sensitive payloads are securely encoded. Furthermore, rigorous code reviews and automated static analysis tools should be employed to detect missing encryption calls, while strict key management practices guarantee that cryptographic keys themselves remain protected from compromise, thereby maintaining the confidentiality and integrity of the entire system.

MITRE CWE Description
The product does not encrypt sensitive or critical information before storage or transmission.
Common Consequences (2)
ConfidentialityRead Application Data
If the application does not use a secure channel, such as SSL, to exchange sensitive information, it is possible for an attacker with access to the network traffic to sniff packets from the connection and uncover the data. This attack is not technically difficult, but does require physical access to…
Confidentiality, IntegrityModify Application Data
Omitting the use of encryption in any program which transfers data over a network of any kind should be considered on par with delivering the data sent to each user on the local networks of both the sender and receiver. Worse, this omission allows for the injection of data into a stream of communica…
Mitigations (5)
RequirementsClearly specify which data or resources are valuable enough that they should be protected by encryption. Require that any transmission or storage of this data/resource should use well-vetted encryption algorithms.
Architecture and DesignEnsure that encryption is properly integrated into the system design, including but not necessarily limited to: Encryption that is needed to store or transmit private data of the users of the system Encryption that is needed to protect the system itself from unauthorized disclosure or tampering Identify the separate needs and contexts for encryption: One-way (i.e., only the user or recipient needs…
Architecture and DesignWhen there is a need to store or transmit sensitive data, use strong, up-to-date cryptographic algorithms to encrypt that data. Select a well-vetted algorithm that is currently considered to be strong by experts in the field, and use well-tested implementations. As with all cryptographic mechanisms, the source code should be available for analysis. For example, US government systems require FIPS 1…
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Implementation, Architecture and DesignWhen using industry-approved techniques, use them correctly. Don't cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.
Examples (2)
This code writes a user's login information to a cookie so the user does not have to login again later.
function persistLogin($username, $password){ $data = array("username" => $username, "password"=> $password); setcookie ("userdata", $data); }
Bad · PHP
The following code attempts to establish a connection, read in a password, then store it to a buffer.
server.sin_family = AF_INET; hp = gethostbyname(argv[1]); if (hp==NULL) error("Unknown host"); memcpy( (char *)&server.sin_addr,(char *)hp->h_addr,hp->h_length); if (argc < 3) port = 80; else port = (unsigned short)atoi(argv[3]); server.sin_port = htons(port); if (connect(sock, (struct sockaddr *)&server, sizeof server) < 0) error("Connecting"); ... while ((n=read(sock,buffer,BUFSIZE-1))!=-1) { write(dfd,password_buffer,n); ...
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2024-7396 Plaintext Communication — JetPort 5601v3 7.5AIHighAI2024-08-05
CVE-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key — Elasticsearch 4.9 Medium2024-07-31
CVE-2024-38302 Dell Data Lakehouse 安全漏洞 — Dell Data Lakehouse 6.8 Medium2024-07-18
CVE-2024-5731 Trellix IPS Manager 安全漏洞 — Intrusion Prevention System (IPS) Manager 6.8 Medium2024-06-14
CVE-2024-38283 Missing Encryption of Sensitive Data in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) — Vigilant Fixed LPR Coms Box (BCAV1F2-C600) 4.6AIMediumAI2024-06-13
CVE-2024-27106 Vulnerable data in transit in GE HealthCare EchoPAC products — EchoPAC Software Only 5.7 Medium2024-05-14
CVE-2024-25027 IBM Security Verify Access Container information disclosure — Security Verify Access Docker 6.2 Medium2024-03-31
CVE-2023-35888 IBM Security Verify Governance information disclosure — Security Verify Governance 5.9 Medium2024-03-20
CVE-2024-28250 Cilium has possible unencrypted traffic between nodes when using WireGuard and L7 policies — cilium 6.1 Medium2024-03-18
CVE-2024-28249 Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies — cilium 6.1 Medium2024-03-18
CVE-2021-39090 IBM Cloud Pak for Security information disclosure — Cloud Pak for Security 5.9 Medium2024-02-29
CVE-2024-25631 Unencrypted traffic between pods when using Wireguard and an external kvstore — cilium 6.1 Medium2024-02-20
CVE-2024-25630 Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption — cilium 6.1 Medium2024-02-20
CVE-2023-38267 IBM Security Access Manager Appliance information disclosure — Security Verify Access Appliance 6.2 Medium2024-01-11
CVE-2023-6339 Google Nest WiFi Pro root code-execution & user-data compromise — Wifi Pro 10.0 Critical2024-01-02
CVE-2023-42019 IBM InfoSphere Information Server information disclosure — InfoSphere Information Server 5.9 Medium2023-12-01
CVE-2023-33228 SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability — Network Configuration Manager 4.5 Medium2023-11-01
CVE-2022-22386 IBM Security Verify Privilege information disclosure — Security Verify Privilege 5.3 Medium2023-10-17
CVE-2022-22377 IBM Security Verify Privilege information disclosure — Security Verify Privilege 5.3 Medium2023-10-17
CVE-2022-33161 IBM Security Directory Server information disclosure — Security Directory Server 5.3 Medium2023-10-14
CVE-2023-23371 QVPN Device Client — QVPN Windows 5.2 Medium2023-10-06
CVE-2022-22405 IBM Aspera Faspex information disclosure — Aspera Faspex 5.9 Medium2023-09-08
CVE-2023-33833 IBM Security Verify Information Queue information disclosure — Security Verify Information Queue 2.9 Low2023-08-31
CVE-2023-40251 Genians Genian NAC 安全漏洞 — Genian NAC V4.0 5.2 Medium2023-08-17
CVE-2023-4384 MaximaTech Portal Executivo Cookie missing encryption — Portal Executivo 3.7 Low2023-08-16
CVE-2023-39954 user_oidc app stores client secret unencrypted in database — security-advisories 3.8 Low2023-08-10
CVE-2023-37858 PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels — WP 6070-WVPS 4.9 Medium2023-08-09
CVE-2023-38699 MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue — mindsdb 9.1 Critical2023-08-04
CVE-2023-38688 twitch-tui's connection is not encrypted — twitch-tui 7.5 High2023-08-04
CVE-2023-30561 Lack of Cryptographic Security of IUI Bus — BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015 6.1 Medium2023-07-13

Vulnerabilities classified as CWE-311 (敏感数据加密缺失) represent 257 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.