CWE-258 — Empty Password in Configuration File
CWE-258: Empty Password in Configuration File
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | High |
Description
Using an empty string as a password is insecure.
Common consequences
- Access Control: Gain Privileges or Assume Identity
Mitigations
System Configuration — Passwords should be at least eight characters long -- the longer the better. Avoid passwords that are in any way similar to other passwords you have. Avoid using words that may be found in a dictionary, names book, on a map, etc. Consider incorporating numbers and/or punctuation into your password. If you do use common words, consider replacing letters in that word with numbers and punctuation. However, do not use "similar-looking" punctuation. For example, it is not a good idea to change cat to c@t, ca+, (@+, or anything similar. Finally, it is never appropriate to use an empty string as a password.
References
- CWE page: https://cwe.mitre.org/data/definitions/258.html
- CWE list: https://cwe.mitre.org/data/index.html