CWE-522: Insufficiently Protected Credentials

ClassIncomplete🏆 #25 in Top 25 (2024)

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

View on MITRE
283Related CVEs
8.54Severity Score
Back to CWE Lookup

Technical Details

Structure
Simple

Applicable To

Languages
Not Language-Specific
Platforms

🏆 CWE Top 25 Historical Ranking

2024:#25
Score: 8.54
283 CVEs
Trend:★ New to Top 25

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine analysis methods around the CWE-522 trust boundary

MITRE identifies automated static analysis as applicable detection approaches. Use them to find credentials stored, transmitted, logged, cached, or compared without protections appropriate to their type, lifetime, and replay value. Require a reproducible trace from the initiating input or state transition to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.

CWE-522: detection methods and operational guidanceMITRE CWE

Store passwords with a tunable, salted password hash

Hash passwords with a modern, memory-hard algorithm such as Argon2id, or scrypt when Argon2id is unavailable; reserve bcrypt for legacy compatibility. Use a unique salt for every password, tune the work factor for the deployment, and upgrade hashes after successful authentication. If a pepper is used, keep it in a secrets vault separate from the password database and plan for rotation.

Password Storage Cheat SheetOWASP Foundation

Apply lessons from CVE-2021-22681 in Rockwell Automation products

NVD maps CVE-2021-22681 to CWE-522; insufficient credential protection could expose a key used to verify communication between Logix controllers and engineering software. Use the case to protect machine credentials as rigorously as user passwords, rotate exposed keys, and verify possession of a recoverable shared key cannot authorize an untrusted application.

CVE-2021-22681 DetailNIST National Vulnerability Database

Track CWE-522 as #25 in the 2024 CWE Top 25

CWE-522 ranked #25 in the 2024 CWE Top 25 with a score of 8.54. Use this annual evidence to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure, exploitability, and business impact for severity decisions on individual findings.

2024 CWE Top 25 Most Dangerous Software WeaknessesMITRE CWE

Inspect every credential lifecycle stage for recoverable secrets

Trace credentials through enrollment, entry, transport, storage, reset, rotation, logs, backups, and client caches. Verify passwords use salted adaptive hashing, tokens and keys receive appropriate encryption or hashing, transport is authenticated, and secrets never appear in URLs or diagnostics. Test replay and offline-recovery risk rather than evaluating password composition alone.

Testing for Weak Password PolicyOWASP Foundation

Frequently Asked Questions

What is CWE-522: Insufficiently Protected Credentials?+

CWE-522: Insufficiently Protected Credentials is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Is CWE-522 in the CWE Top 25 Most Dangerous Software Weaknesses?+

Yes. CWE-522 ranked #25 in the CWE Top 25 for 2024, associated with 283 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

What are the security consequences of Insufficiently Protected Credentials?+

If exploited, CWE-522 (Insufficiently Protected Credentials) it can compromise Access Control, leading to outcomes such as Gain Privileges or Assume Identity.

How do you prevent or mitigate Insufficiently Protected Credentials?+

Recommended mitigations for CWE-522 include: Use an appropriate security mechanism to protect the credentials. Make appropriate use of cryptography to protect the credentials. Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Which programming languages are affected by Insufficiently Protected Credentials?+

CWE-522 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Insufficiently Protected Credentials?+

MITRE documents real CVEs mapped to CWE-522, including CVE-2022-30018, CVE-2022-29959, CVE-2022-35411, CVE-2022-29519 and CVE-2022-30312. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-522 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Advertisement