Security

What is Cleartext Storage of Sensitive (CWE-315)?

Learn how to prevent and fix Cleartext Storage of Sensitive Information in a Cookie, a critical vulnerability that occurs when sensitive information is...

SP
Shreya Pillai July 28, 2026 5 min read Security
AI-friendly summary

What it is: Cleartext Storage of Sensitive Information in a Cookie (CWE-315) is a type of security misconfiguration vulnerability that occurs when sensitive information is stored in cleartext in a cookie.

Why it matters: This vulnerability can lead to unauthorized access and potential security breaches, compromising confidentiality, integrity, and availability.

How to fix it: You can fix Cleartext Storage of Sensitive Information in a Cookie by removing sensitive information from the cookie, using secure cookies, or implementing proper encryption.

TL;DR: Cleartext Storage of Sensitive Information in a Cookie (CWE-315) is a critical vulnerability that occurs when sensitive information is stored in cleartext in a cookie. You can fix it by removing sensitive information from the cookie, using secure cookies, or implementing proper encryption.

At-a-Glance Table

Field Value
CWE ID CWE-315
OWASP Category A02:2025 - Security Misconfiguration
CAPEC CAPEC-31, CAPEC-37, CAPEC-39, CAPEC-74
Typical Severity Critical
Affected Technologies Web applications, cookies, session management
Detection Difficulty Moderate
Last Updated 2026-07-28

Cleartext Storage of Sensitive Information in a Cookie (CWE-315) is a type of security misconfiguration vulnerability that occurs when sensitive information is stored in cleartext in a cookie. As defined by the MITRE Corporation under CWE-315, and classified by the OWASP Foundation under A02:2025 - Security Misconfiguration, this vulnerability can lead to unauthorized access and potential security breaches.

Quick Summary

Cleartext Storage of Sensitive Information in a Cookie (CWE-315) is a critical vulnerability that occurs when sensitive information is stored in cleartext in a cookie. This vulnerability can lead to unauthorized access and potential security breaches, compromising confidentiality, integrity, and availability. To fix this issue, you can remove sensitive information from the cookie, use secure cookies, or implement proper encryption.

Jump to: What is Cleartext Storage of Sensitive Information in a Cookie? · Quick Summary · Cleartext Storage of Sensitive Information in a Cookie Overview · How Cleartext Storage of Sensitive Information in a Cookie Works · Business Impact of Cleartext Storage of Sensitive Information in a Cookie · Cleartext Storage of Sensitive Information in a Cookie Attack Scenario · How to Detect Cleartext Storage of Sensitive Information in a Cookie · How to Fix Cleartext Storage of Sensitive Information in a Cookie · Framework-Specific Fixes for Cleartext Storage of Sensitive Information in a Cookie · How to Ask AI to Check Your Code for Cleartext Storage of Sensitive Information in a Cookie · Cleartext Storage of Sensitive Information in a Cookie Best Practices Checklist · Cleartext Storage of Sensitive Information in a Cookie FAQ · Vulnerabilities Related to Cleartext Storage of Sensitive Information in a Cookie · References · Scan Your Own Site

What: Cleartext Storage of Sensitive Information in a Cookie (CWE-315) is a type of security misconfiguration vulnerability that occurs when sensitive information is stored in cleartext in a cookie.

Why it matters: This vulnerability can lead to unauthorized access and potential security breaches, compromising confidentiality, integrity, and availability.

Where it occurs: Cleartext Storage of Sensitive Information in a Cookie (CWE-315) typically occurs in web applications that store sensitive information in cookies.

Who is affected: Web application users who interact with the vulnerable cookie are affected by this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input and systems already using secure cookies or proper encryption are not affected by this vulnerability.

Root Cause

Cleartext Storage of Sensitive Information in a Cookie (CWE-315) occurs when sensitive information is stored in cleartext in a cookie.

Attack Flow

  1. An attacker intercepts the vulnerable cookie.
  2. The attacker uses the intercepted cookie to access sensitive information.
  3. The attacker exploits the vulnerability by using the sensitive information for malicious purposes.

Prerequisites to Exploit

  • The attacker must have access to the vulnerable cookie.
  • The cookie must contain sensitive information in cleartext.

Vulnerable Code

import os

# Set a cookie with sensitive information in cleartext
os.environ['COOKIE'] = 'sensitive_info'

Secure Code

import os

# Set a secure cookie with encrypted sensitive information
os.environ['COOKIE'] = 'encrypted_sensitive_info'

The vulnerable code stores sensitive information in cleartext in the cookie, while the secure code encrypts the sensitive information before storing it in the cookie.

Confidentiality: The vulnerability can lead to unauthorized access and potential security breaches, compromising confidentiality.

Integrity: The attacker can modify or delete sensitive information stored in the cookie, compromising integrity.

Availability: The vulnerability can disrupt the availability of web applications, making them inaccessible to users.

Real-world business consequences include:

  • Financial losses due to data breaches
  • Compliance issues with regulatory bodies
  • Reputation damage due to security incidents
  1. An attacker intercepts the vulnerable cookie.
  2. The attacker uses the intercepted cookie to access sensitive information.
  3. The attacker exploits the vulnerability by using the sensitive information for malicious purposes.

Manual Testing

  • Review web application code and configuration files for potential vulnerabilities.
  • Use tools like Burp Suite or ZAP to identify potential vulnerabilities.

Automated Scanners (SAST/DAST)

  • Use automated scanners to identify potential vulnerabilities in the web application.
  • Contrast what static analysis catches with what needs dynamic/runtime testing to find.

PenScan Detection

  • PenScan’s scanner engines actively test for this issue and provide recommendations for remediation.

False Positive Guidance

  • Be cautious of false positives due to context that a scanner can’t see, such as:
    • Cookies set by third-party libraries or frameworks
    • Cookies used for legitimate purposes, such as session management
  • Remove sensitive information from the cookie.
  • Use secure cookies with encrypted sensitive information.
  • Implement proper encryption and decryption mechanisms.

Java

import javax.servlet.http.Cookie;

// Set a secure cookie with encrypted sensitive information
Cookie cookie = new Cookie("encrypted_sensitive_info", "sensitive_info");

Node.js

const express = require('express');
const cookieParser = require('cookie-parser');

// Set a secure cookie with encrypted sensitive information
app.use(cookieParser());
app.get('/set-cookie', (req, res) => {
  const cookie = new Cookie('encrypted_sensitive_info', 'sensitive_info');
  res.cookie(cookie);
});

Python/Django

import os

# Set a secure cookie with encrypted sensitive information
os.environ['COOKIE'] = 'encrypted_sensitive_info'

PHP

<?php
// Set a secure cookie with encrypted sensitive information
setcookie('encrypted_sensitive_info', 'sensitive_info');
?>

Review the following [language] code block for potential CWE-315 Cleartext Storage of Sensitive Information in a Cookie vulnerabilities and rewrite it using primary fix technique:

import os

# Set a cookie with sensitive information in cleartext
os.environ['COOKIE'] = 'sensitive_info'

Rewrite the code to use secure cookies with encrypted sensitive information.

✅ Use secure cookies with encrypted sensitive information. ✅ Implement proper encryption and decryption mechanisms. ✅ Remove sensitive information from the cookie. ✅ Review web application code and configuration files for potential vulnerabilities. ✅ Use automated scanners to identify potential vulnerabilities.

Cleartext Storage of Sensitive Information in a Cookie occurs when sensitive information is stored in cleartext in a cookie.

The consequences of Cleartext Storage of Sensitive Information in a Cookie include read application data, which can lead to unauthorized access and potential security breaches.

You can detect Cleartext Storage of Sensitive Information in a Cookie by using manual testing, automated scanners (SAST/DAST), or PenScan detection.

The best practices for preventing Cleartext Storage of Sensitive Information in a Cookie include using secure cookies, encrypting sensitive information, and implementing proper session management.

You can fix Cleartext Storage of Sensitive Information in a Cookie by removing sensitive information from the cookie, using secure cookies, or implementing proper encryption.

Yes, AI-powered tools like PenScan can help you detect and prevent Cleartext Storage of Sensitive Information in a Cookie by identifying potential vulnerabilities and providing recommendations for remediation.

The related vulnerabilities to Cleartext Storage of Sensitive Information in a Cookie include CWE-312, Cleartext Storage of Sensitive Information (ChildOf).

CWE Name Relationship
CWE-312 Cleartext Storage of Sensitive Information (ChildOf)  

References

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Cleartext Storage of Sensitive Information in a Cookie and other risks before an attacker does.