Weakness (CWE)
CWE-836: Use of Password Hash Instead of Password for Authentication
The product includes a client that computes a hash of a password and sends the hash to another component, which compares the supplied hash to the hash obtained from a data store of password hashes.
Source: MITRE CWE-836
3 results · Clear filters · Feed
-
Critical 9.1
motionEye: Authentication possible via password hash
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authenticati…
-
Critical 9.0
Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication
Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.
-
Critical 10.0
Login with hash
Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.