Weakness (CWE)
CWE-521: Weak Password Requirements
The product does not require that users should have strong passwords.
How to prevent it (4 mitigations)
-
Architecture and Design
A product's design should require adherence to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes:
- Enforcement of a minimum and maximum length
- Restrictions against password reuse
- Restrictions against using common passwords
- Restrictions against using contextual string in the password (e.g., user id, app name)
Depending on the threat model, the password policy may include several additional attributes.
- Complex passwords requiring mixed character sets (alpha, numeric, special, mixed case)
- Increasing the range of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- Unfortunately, a complex password may be difficult to memorize, encouraging a user to select a short password or to incorrectly manage the password (write it down).
- Another disadvantage of this approach is that it often does not result in a significant increase in overall password complexity due to people's predictable usage of various symbols.
- Large Minimum Length (encouraging passphrases instead of passwords)
- Increasing the number of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- A disadvantage of this approach is that selecting a good passphrase is not easy and poor passwords can still be generated. Some prompting may be needed to encourage long un-predictable passwords.
- Randomly Chosen Secrets
- Generating a password for the user can help make sure that length and complexity requirements are met, and can result in secure passwords being used.
- A disadvantage of this approach is that the resulting password or passphrase may be too difficult to memorize, encouraging them to be written down. However, there is growing adoption of password managers that allow users to manage many passwords with varying complexity requirements.
See NIST 800-63B [REF-1053] for further information on password requirements.
-
Architecture and Design
Consider a second
authentication factor beyond the password, which prevents the
password from being a single point of failure. See CWE-308 for
further information. -
Implementation
Consider implementing a password complexity meter to inform users when a chosen password meets the required attributes.
-
Implementation
Previously, "password expiration" was
widely advocated as a defense-in-depth approach to
minimize the risk of weak passwords, and it has become
a common practice. Password expiration requires a
password to be changed within a fixed time window (such
as every 90 days). However, this approach has
significant limitations in the current threat
landscape, and its utility has been reduced in light of
the adoption of related protection mechanisms (such as
password complexity and computational effort), along
with the recognition that regular password changes
often caused users to generate more predictable
passwords. As a result, this is now a Discouraged
Common Practice [REF-1488] [REF-1489], especially as
the sole factor in protecting passwords. It is still
strongly encouraged to force password changes in case
of evidence of compromise, but this is not the same as
a forced "expiration" on an arbitrary time
frame.
Source: MITRE CWE-521
168 results · Feed
-
Low 3.7
PHPGurukul Employee Leaves Management System changepassword.php weak password
A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file changepassword.php. The manipulation of the argument newpassword/confirm…
-
Critical 9.8
A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device w…
-
High 8.1
Weak Password Requirements in publify/publify
Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
-
Medium 5.4
Weak Password Requirements in froxlor/froxlor
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.7
Weak Password Requirements in thorsten/phpmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
-
Medium 6.5
Weak password requirements in Kiwi TCMS
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by…
-
Critical 9.8
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.
-
High 7.5
A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, build…
-
Critical 9.8
Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthentica…
-
High 7.2
Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a co…
-
High 7.5
Weak Password Requirements in thorsten/phpmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
-
Low 3.5
Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
-
Medium 5.4
Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.
-
Critical 9.8
Weak Password Requirements in ikus060/minarca
Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.
-
High 7.1
Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
-
Medium 5.9
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
-
High 7.3
Weak Password Requirements in notrinos/notrinoserp
Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.
-
Critical 9.8
Raneto v0.17.0 employs weak password complexity requirements
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
-
Critical 9.8
BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-f…
-
Critical 9.8
Secheron SEPCOS Control and Protection Relay
Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
-
High 7.1
Weak Password Requirements in kromitgmbh/titra
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.
-
High 8.1
Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administr…
-
High 8.4
Weak Password Requirements in polonel/trudesk
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.
-
Critical 9.6
ICSA-22-104-03 Red Lion DA50N
The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default en…
-
Medium 4.3
Weak Password Requirements in weseek/growi
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
-
High 7.5
DayByDay CRM - Weak Password Requirements in Update User
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allo…
-
Critical 9.0
Weak default credential associated with TCP port 26
Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi En…
-
Critical 9.8
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations …
-
Critical 9.8
ECOA BAS controller - Weak Password Requirements
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
-
High 8.3
Weak password in API gateway in EdgeX Foundry Edinburgh, Fuji, Geneva, and Hanoi releases allows remote attackers to obtain authentication token via dictionary-based password attack when OAuth2 authentication method is enabled.
EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 …
-
High 8.8
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a …
-
Critical 9.8
MOXA NPort IAW5000A-I/O Series
The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.
-
Critical 9.8CVE-2019-17444 EPSS 69%
JFrog Artifactory does not enforce default admin password change
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Ar…
-
Medium 5.8
No minimum password length in etcd
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational ef…
-
Unscored —
A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could a…
-
Unscored —
A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the di…
-
Medium 6.5
ABB eSOMS: Password complexity issue
eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords.
-
Unscored —
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain acces…
-
Unscored —
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the applicati…
-
Unscored —
In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the…