Empty Password in Configuration File

Opis

Using an empty string as a password is insecure.

Skutki

• Access Control

  Gain Privileges or Assume Identity

Zapobieganie

• System Configuration

  Passwords should be at least eight characters long -- the longer the better. Avoid passwords that are in any way similar to other passwords you have. Avoid using words that may be found in a dictionary, names book, on a map, etc. Consider incorporating numbers and/or punctuation into your password. If you do use common words, consider replacing letters in that word with numbers and punctuation. However, do not use "similar-looking" punctuation. For example, it is not a good idea to change cat to c@t, ca+, (@+, or anything similar. Finally, it is never appropriate to use an empty string as a password.

Przykłady podatności

• CVE-2022-26117 Network access control (NAC) product has a configuration file with an empty password

Słabość nadrzędna

• CWE-260 Password in Configuration File
• CWE-521 Weak Password Requirements

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• Operation

Dotyczy

Not Language-Specific

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. Building Secure Software: How to Avoid Security Problems the Right Way — John Viega, Gary McGraw, Addison-Wesley, 2002