What is CWE-311: Missing Encryption of Sensitive Data?+
CWE-311: Missing Encryption of Sensitive Data is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not encrypt sensitive or critical information before storage or transmission.
What are the security consequences of Missing Encryption of Sensitive Data?+
If exploited, CWE-311 (Missing Encryption of Sensitive Data) it can compromise Confidentiality and Integrity, leading to outcomes such as Read Application Data and Modify Application Data.
How do you prevent or mitigate Missing Encryption of Sensitive Data?+
Recommended mitigations for CWE-311 include: Clearly specify which data or resources are valuable enough that they should be protected by encryption. Require that any transmission or storage of this data/resource should use well-vetted encryption algorithms. Ensure that encryption is properly integrated into the system design, including but not necessarily limited to: Encryption that is needed to store or transmit private data of the users of the system Encryption that is needed to protect the system itself from unauthorized disclosure or tampering Identify the separate needs and contexts for encryption: One-way (i.e., only the user or recipient needs to have the key). This can be achieved using public key cryptography, or other techniques in which the encrypting party (i.e., the product) does not need to have access to a private key. Two-way (i.e., the encryption can be automatically performed on behalf of a user, but the key must be available so that the plaintext can be automatically recoverable by that user). This requires storage of the private key in a format that is recoverable only by the user (or perhaps by the operating system) in a way that cannot be recovered by others. Using threat modeling or other techniques, assume that data can be compromised through a separate vulnerability or weakness, and determine where encryption will be most effective. Ensure that data that should be private is not being inadvertently exposed using weaknesses such as insecure permissions (CWE-732). [REF-7]
How is Missing Encryption of Sensitive Data detected?+
CWE-311 can be detected using Manual Analysis, Automated Analysis, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation and Manual Static Analysis - Source Code. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by Missing Encryption of Sensitive Data?+
CWE-311 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Missing Encryption of Sensitive Data?+
MITRE documents real CVEs mapped to CWE-311, including CVE-2022-26390, CVE-2009-2272, CVE-2009-1466, CVE-2009-0152 and CVE-2009-1603. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-311 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.