CWE-313 (在文件或磁盘上的明文存储) — Vulnerability Class 25

CWE-313 represents a critical data protection weakness where applications store sensitive information in plaintext on disk or in files, leaving it vulnerable to unauthorized access. Attackers typically exploit this flaw by gaining physical access to the device, obtaining administrative privileges, or directly reading storage media to extract credentials, keys, or personal data. Even if the data appears obfuscated through simple encoding, determined adversaries can often reverse-engineer the method to reveal the original content. To mitigate this risk, developers must implement robust encryption standards, such as AES-256, for all sensitive data at rest. Additionally, utilizing hardware security modules and ensuring strict file permission controls can significantly reduce the attack surface, ensuring that stored information remains confidential even if the underlying storage is compromised.