A02: Cryptographic Failures · 2021

Sensitive data is exposed when cryptographic controls are missing or unsuitable algorithms, protocols, keys or settings are used.

Summary

Sensitive data is exposed when cryptographic controls are missing or unsuitable algorithms, protocols, keys or settings are used.

How the attack works

An unsalted MD5 hash enables fast password guesses after a database leak; a salted adaptive hash makes those guesses costly.

Example

Vulnerable · Pseudocode

password_hash = md5(password)

Fix: Use Argon2id with a unique salt and appropriate cost parameters.

Prevention

Classify and minimize stored sensitive data.
Use modern encryption for data in transit and at rest.
Manage keys outside the code and rotate them through controlled processes.

Lineage

2013 · A6: Sensitive Data Exposure Moves up to rank 3 in 2017
2017 · A3: Sensitive Data Exposure Renamed in 2021
2021 · A02: Cryptographic Failures Renamed from Sensitive Data Exposure
2025 · A04: Cryptographic Failures Moves down from rank 2

2013:A6 → 2017:A3: Sensitive Data Exposure moves up to rank 3.
2017:A3 → 2021:A02: Sensitive Data Exposure is reframed as Cryptographic Failures.
2021:A02 → 2025:A04: Cryptographic Failures moves down from rank 2 to 4.

Sources

Open official source ↗

Buy me a coffee