documentation_complete: true

title: 'Disable or Remove Clear-Text Passwords'

description: |-
    Eliminate clear-text passwords in JBoss configuration
    files. All passwords should be encrypted and all password files
    should have restricted file permissions.

rationale: |-
    Clear-text passwords are an unnecessary security vulnerability.
    While risk of exposure can be mitigated through configured
    permissions and file ownership, these methods do not completely
    remediate the risk.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: SC-28

ocil_clause: 'passwords are not encrypted'
