Weakness (CWE)
CWE-258: Empty Password in Configuration File
Using an empty string as a password is insecure.
How to prevent it (1 mitigation)
-
System Configuration
Passwords should be at least eight characters long -- the longer the better. Avoid passwords that are in any way similar to other passwords you have. Avoid using words that may be found in a dictionary, names book, on a map, etc. Consider incorporating numbers and/or punctuation into your password. If you do use common words, consider replacing letters in that word with numbers and punctuation. However, do not use "similar-looking" punctuation. For example, it is not a good idea to change cat to c@t, ca+, (@+, or anything similar. Finally, it is never appropriate to use an empty string as a password.
Source: MITRE CWE-258
4 results · Clear filters · Feed
-
Critical 9.8
blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose
blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker h…
-
Critical 9.8
D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in …
-
Critical 9.8
Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability
Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-ce…
-
Critical 9.8
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vuln…