VYPR

CWE-916

Use of Password Hash With Insufficient Computational Effort

BaseIncomplete

Description

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-55

CVEs mapped to this weakness (123)

page 7 of 7
  • CVE-2019-20138HigDec 30, 2019
    risk 0.00cvss 7.5epss 0.01

    The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used.

  • CVE-2014-2354May 30, 2014
    risk 0.00cvss epss 0.01

    Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.

  • CVE-2009-4269Aug 16, 2010
    risk 0.00cvss epss 0.01

    The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly…