...
Hard coding sensitive information exposes that information to attackers. The severity of this rule can vary depending on the kind of information that is disclosed. Frequently, the information disclosed is password or key information, which can lead to remote exploitation. Consequently, a high severity rating is given but may be adjusted downwards according to the nature of the sensitive data.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
MSC03-J | High | Probable | No | NoMedium | P12P6 | L1L2 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| JAVA.HARDCODED.PASSWD | Hardcoded Password (Java) | ||||||
| Coverity | 7.5 | HARDCODED_CREDENTIALS | Implemented | ||||||
| Fortify | 1.0 | Password_Management | Partially implemented | ||||||
| Parasoft Jtest |
| CERT.MSC03.HCCS CERT.MSC03.HCCK CERT.MSC03.AHCA | Avoid passing hardcoded usernames/passwords/URLs to database connection methods Avoid using hard-coded cryptographic keys Avoid hard-coding the arguments to certain methods | ||||||
| PMD | 1.0 | AvoidUsingHardCodedIP | Partially implemented | ||||||
| PVS-Studio |
| V5331 | |||||||
| SonarQube |
| S1313 S2068 | Partially implemented |
...