Cyber Resilience

CWE · MITRE source

CWE-256Plaintext Storage of a Password

Abstraction: Base · CVEs in our corpus: 217

The product stores a password in plaintext within resources such as memory or files.

Last updated: 21 August 2026 00:24 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A06:2025 Insecure Design.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-28 Protection of Information at Rest
  • PR.DS-01
  • PR.DS-10
  • PR.AA-01
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control Title Family Why it addresses this CWE
SC-28Protection of Information at RestSCProtection of passwords and credentials at rest forces encryption or equivalent controls instead of plaintext storage.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2017-16714 7.79.80.02432018-09-06
CVE-2020-6961 7.710.00.01622020-01-24
CVE-2018-7510 7.69.80.01402018-06-06
CVE-2018-8851 7.69.80.01312018-07-24
CVE-2017-7913 7.59.80.01182017-05-29
CVE-2025-27656 7.59.80.00872025-03-05
CVE-2024-36081 7.49.80.00572024-05-19
CVE-2024-33375 7.49.80.00622024-06-14
CVE-2025-27662 7.49.80.00602025-03-05
CVE-2024-23486 7.39.80.00562024-04-15
CVE-2024-5960 7.39.80.00442024-09-18
CVE-2025-5893 7.39.80.00422025-06-09
CVE-2025-6560 7.39.80.00562025-06-24
CVE-2025-6561 7.39.80.00502025-06-26
CVE-2024-550267.29.80.00342026-03-03
CVE-2026-216607.19.80.00232026-02-27
CVE-2022-36308 7.09.10.00712022-08-16
CVE-2024-26165 6.98.80.01922024-03-12
CVE-2024-6118 6.99.10.00482024-08-05
CVE-2023-4918 6.68.80.00472023-09-12
CVE-2024-3622 6.68.80.00522024-04-25
CVE-2020-5374 6.58.80.01042020-07-14
CVE-2023-41610 6.58.80.00402024-09-18
CVE-2025-15113 6.59.30.00452025-12-30
CVE-2019-10921 6.37.50.02452019-05-14