What CVEs are caused by CWE-318?

1 recorded CVEs are attributed to CWE-318, including CVE-2022-34388.

What are the consequences of CWE-318?

Exploiting CWE-318 can lead to: Read Application Data.

Is CWE-318 actively exploited?

1 recorded CVEs are caused by CWE-318; none are currently in CISA's KEV catalog of actively exploited flaws.

Variant weakness

Draft

CWE-318: Cleartext Storage of Sensitive Information in Executable

The product stores sensitive information in cleartext in an executable.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Variant

Abstraction

MITRE classification

Overview

Attackers can reverse engineer binary code to obtain secret data. This is especially easy when the cleartext is plain ASCII. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Real-world CVEs

1 recorded CVEs are caused by CWE-318 (Cleartext Storage of Sensitive Information in Executable). The highest-severity and most recent are shown first.

CVE-2022-34388
High · CVSS 7.1 · EPSS 6th
2023-02-10

Common consequences

What can happen when CWE-318 is exploited.

Read Application Data

Affects: Confidentiality

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2005-1794 — Product stores RSA private key in a DLL and uses it to sign a certificate, allowing spoofing of servers and Adversary-in-the-Middle (AITM) attacks.
CVE-2001-1527 — administration passwords in cleartext in executable

Terminology & mappings

Mapped taxonomies

PLOVER: Plaintext Storage in Executable

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-318.

What is CWE-318?: The product stores sensitive information in cleartext in an executable.
What CVEs are caused by CWE-318?: 1 recorded CVEs are attributed to CWE-318, including CVE-2022-34388.
What are the consequences of CWE-318?: Exploiting CWE-318 can lead to: Read Application Data.
Is CWE-318 actively exploited?: 1 recorded CVEs are caused by CWE-318; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-318

Get alerted the moment a new CWE-318 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing