CWE-916
Use of Password Hash With Insufficient Computational Effort
Description
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-55
CVEs mapped to this weakness (123)
page 7 of 7| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-20138 | Hig | 0.00 | 7.5 | 0.01 | Dec 30, 2019 | The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used. | ||
| CVE-2014-2354 | 0.00 | — | 0.01 | May 30, 2014 | Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack. | |||
| CVE-2009-4269 | 0.00 | — | 0.01 | Aug 16, 2010 | The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly… |
- risk 0.00cvss 7.5epss 0.01
The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used.
- CVE-2014-2354May 30, 2014risk 0.00cvss —epss 0.01
Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
- CVE-2009-4269Aug 16, 2010risk 0.00cvss —epss 0.01
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly…