CWE · MITRE source
CWE-522Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Last updated: 21 August 2026 20:21 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 18 mapping(s) from 2 framework(s): CAPEC 12 (partial) · ATT&CK 6 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A06:2025 Insecure Design.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
- 1 hardening rule · 1 OS baseline
V11.3.3
NIST 800-53 r5 controls that address this weakness (7)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
AT-2 | Literacy Training and Awareness | AT | Training instructs users on protecting credentials from disclosure or unauthorized access. |
AT-4 | Training Records | AT | Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials. |
SC-28 | Protection of Information at Rest | SC | Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores. |
SC-37 | Out-of-band Channels | SC | Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport. |
IA-5 | Authenticator Management | IA | Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials. |
PL-4 | Rules of Behavior | PL | Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials. |
PS-4 | Personnel Termination | PS | Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2021-30116 KEV UPD | 10.0 | 10.0 | 0.8573 | 2021-07-09 |
CVE-2017-9248 KEV UPD | 9.9 | 9.8 | 0.7510 | 2017-07-03 |
CVE-2018-9160 UPD | 9.9 | 9.8 | 0.7598 | 2018-03-31 |
CVE-2019-17662 UPD | 9.9 | 9.8 | 0.9676 | 2019-10-16 |
CVE-2020-29583 KEV UPD | 9.9 | 9.8 | 0.9015 | 2020-12-22 |
CVE-2021-22681 KEV UPD | 9.9 | 9.8 | 0.6099 | 2021-03-03 |
CVE-2024-44000 UPD | 9.9 | 9.8 | 0.8214 | 2024-10-20 |
CVE-2017-7925 UPD | 9.4 | 9.8 | 0.5142 | 2017-05-06 |
CVE-2024-32238 UPD | 9.4 | 9.8 | 0.5295 | 2024-04-22 |
CVE-2022-37109 UPD | 9.3 | 9.8 | 0.4948 | 2022-11-14 |
CVE-2014-1812 KEV UPD | 9.2 | 8.8 | 0.6512 | 2014-05-14 |
CVE-2022-35411 UPD | 9.2 | 9.8 | 0.4614 | 2022-07-08 |
CVE-2017-3192 UPD | 9.1 | 9.8 | 0.3948 | 2017-12-16 |
CVE-2013-7052 UPD | 8.7 | 9.8 | 0.2468 | 2020-02-04 |
CVE-2017-8225 UPD | 8.5 | 9.8 | 0.1800 | 2017-04-25 |
CVE-2017-17106 UPD | 8.4 | 9.8 | 0.1526 | 2017-12-19 |
CVE-2018-11742 UPD | 8.4 | 9.8 | 0.1434 | 2018-12-26 |
CVE-2018-10824 UPD | 8.3 | 9.8 | 0.1248 | 2018-10-17 |
CVE-2014-6039 UPD | 8.3 | 7.5 | 0.6878 | 2020-01-13 |
CVE-2025-0890 UPD | 8.3 | 9.8 | 0.1354 | 2025-02-04 |
CVE-2000-0944 UPD | 8.2 | 9.8 | 0.1127 | 2000-12-19 |
CVE-2014-5381 UPD | 8.1 | 9.8 | 0.0706 | 2020-01-13 |
CVE-2023-28131 UPD | 8.1 | 9.6 | 0.2299 | 2023-04-24 |
CVE-2019-7260 UPD | 8.0 | 9.8 | 0.0663 | 2019-07-02 |
CVE-2014-3445 UPD | 8.0 | 9.8 | 0.0534 | 2020-01-28 |