2396
Category-950: SFP Secondary Cluster: Hardcoded Sensitive Data
Category ID : 950
Summary
This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster
(SFP33).
Membership
Nature Type ID Name Page
MemberOf 898 SFP Primary Cluster: Authentication 888 2385
HasMember 258 Empty Password in Configuration File 888 621
HasMember 259 Use of Hard-coded Password 888 623
HasMember 321 Use of Hard-coded Cryptographic Key 888 785
HasMember 547 Use of Hard-coded, Security-relevant Constants 888 1259
Category-951: SFP Secondary Cluster: Insecure Authentication Policy
Category ID : 951
Summary
This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy
cluster.
Membership
Nature Type ID Name Page
MemberOf 898 SFP Primary Cluster: Authentication 888 2385
HasMember 262 Not Using Password Aging 888 633
HasMember 263 Password Aging with Long Expiration 888 636
HasMember 521 Weak Password Requirements 888 1223
HasMember 556 ASP.NET Misconfiguration: Use of Identity
Impersonation
888 1271
HasMember 613 Insufficient Session Expiration 888 1371
HasMember 645 Overly Restrictive Account Lockout Mechanism 888 1423
Category-952: SFP Secondary Cluster: Missing Authentication
Category ID : 952
Summary
This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.
Membership
Nature Type ID Name Page
MemberOf 898 SFP Primary Cluster: Authentication 888 2385
HasMember 306 Missing Authentication for Critical Function 888 741
HasMember 620 Unverified Password Change 888 1383
CWE Version 4.14
CWE-953: SFP Secondary Cluster: Missing Endpoint Authentication
CWE-953: SFP Secondary Cluster: Missing Endpoint Authentication