Missing Password Field Masking

Opis

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

Skutki

• Access Control

  Bypass Protection Mechanism

Zapobieganie

• Implementation, Requirements

  Recommendations include requiring all password fields in your web application be masked to prevent other users from seeing this information.

Przykłady podatności

• CVE-2025-0148 Jenkins plugin for a video meeting product does not mask passwords

Słabość nadrzędna

• CWE-522 Insufficiently Protected Credentials

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific, Web Based

Źródła

1. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 19: Use of Weak Password-Based Systems." Page 279, McGraw-Hill, 2010