Security Resilience

CWE · MITRE source

CWE-522Insufficiently Protected Credentials

Abstraction: Class · CVEs in our corpus: 1,542

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Last updated: 15 October 2026 10:21 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A06:2025 Insecure Design.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • AT-2 Literacy Training and Awareness
  • AT-4 Training Records
  • SC-28 Protection of Information at Rest
  • SC-37 Out-of-band Channels
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (7)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
AT-2Literacy Training and AwarenessATTraining instructs users on protecting credentials from disclosure or unauthorized access.
AT-4Training RecordsATTraining records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
SC-28Protection of Information at RestSCRequiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.
SC-37Out-of-band ChannelsSCCredentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.
IA-5Authenticator ManagementIAProtecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
PL-4Rules of BehaviorPLRules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
PS-4Personnel TerminationPSTerminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-30116 KEV 10.010.00.85732021-07-09
CVE-2017-9248 KEV 9.99.80.75102017-07-03
CVE-2018-9160 9.99.80.75602018-03-31
CVE-2019-17662 9.99.80.96762019-10-16
CVE-2020-29583 KEV 9.99.80.90152020-12-22
CVE-2021-22681 KEV 9.99.80.63632021-03-03
CVE-2024-44000 9.99.80.82342024-10-20
CVE-2017-7925 9.49.80.51422017-05-06
CVE-2024-32238 9.49.80.52952024-04-22
CVE-2022-37109 9.39.80.49482022-11-14
CVE-2014-1812 KEV 9.28.80.64882014-05-14
CVE-2022-35411 9.29.80.45722022-07-08
CVE-2017-3192 9.19.80.39482017-12-16
CVE-2017-8225 9.09.80.35122017-04-25
CVE-2013-7052 8.79.80.24682020-02-04
CVE-2017-17106 8.49.80.15262017-12-19
CVE-2018-11742 8.49.80.14342018-12-26
CVE-2018-10824 8.39.80.12482018-10-17
CVE-2014-6039 8.37.50.68782020-01-13
CVE-2025-0890 8.39.80.13652025-02-04
CVE-2000-0944 8.29.80.11272000-12-19
CVE-2014-5381 8.19.80.07062020-01-13
CVE-2022-28005 8.19.80.08352022-05-06
CVE-2023-28131 8.19.60.23162023-04-24
CVE-2019-7260 8.09.80.06632019-07-02