CWE-319: Cleartext Transmission of Sensitive Information
A weakness where sensitive data is transmitted in a way that allows it to be read by an unauthorized actor in transit.
Why It Matters
This weakness requires no application-level compromise to exploit — only network position, which is achievable on any shared or hostile network the device connects to.
Application to Application Security
The CWE-level description of OWASP Mobile M5 and ASVS V9 — cleartext HTTP, disabled certificate validation, and permissive ATS/network-security-config exceptions are all instances of this same weakness.
Relation to Software Development
Frequently introduced (and later forgotten) as a debug-time convenience to reach a local or staging server that doesn't have TLS configured.
How Strata Surfaces This
Static detection of plaintext URLs, manifest and Info.plist exception parsing, and TLS version/cipher analysis against the app's network security configuration.
Developer guidance
Remove debug-time cleartext exceptions before release and enforce TLS at the networking-layer level so no individual call site can opt out silently.
Management guidance
This is one of the most reliably preventable weaknesses on this list — a release checklist item, not a deep technical fix, closes most instances of it.