Cleartext Transmission of Sensitive Information (CWE-319)

Sensitive information is information that needs to be protected from unauthorized parties.

Types of Sensitive Information:
  1. Personally Identifiable Information (PII)
    • Like Bank account number, Credit card number, Mobile number, Aadhar number, Biometric Data, etc.
  2. Business Confidential Information
  3. Classified information

All such Sensitive Information should not be transmitted over unencrypted channels like HTTP. Otherwise, there are chances that it gets compromised.

For this, an attacker needs to eavesdrop on each data packets sent from you, which is generally possible only if the attacker is in the same network as you are.

Types of this Vulnerability:
  1. Passwords transmitted in cleartext.
  2. The server sends passwords in cleartext to a log server.
  3. The server sends cleartext passwords in an email.