CWE-521
Weak Password Requirements
Description
The product does not require that users should have strong passwords.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-112 · CAPEC-16 · CAPEC-49 · CAPEC-509 · CAPEC-55 · CAPEC-555 · CAPEC-561 · CAPEC-565 · CAPEC-70
CVEs mapped to this weakness (264)
page 14 of 14| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-1236 | Med | 0.00 | 6.5 | 0.01 | Apr 5, 2022 | Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0. | ||
| CVE-2021-25923 | Hig | 0.00 | 8.1 | 0.01 | Jun 24, 2021 | In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover. | ||
| CVE-2020-8296 | Med | 0.00 | 6.7 | 0.01 | Mar 3, 2021 | Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. | ||
| CVE-2020-8632 | Med | 0.00 | 5.5 | 0.00 | Feb 5, 2020 | In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords. |
- risk 0.00cvss 6.5epss 0.01
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
- risk 0.00cvss 8.1epss 0.01
In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.
- risk 0.00cvss 6.7epss 0.01
Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
- risk 0.00cvss 5.5epss 0.00
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.