794
Reference Description
CVE-2021-33020 Picture Archiving and Communication System (PACS) system for hospitals
uses a cryptographic key or password past its expiration date
https://www.cve.org/CVERecord?id=CVE-2021-33020
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 959 SFP Secondary Cluster: Weak Cryptography 888 2398
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Using a key past its expiration date
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-325: Missing Cryptographic Step
Weakness ID : 325
Structure : Simple
Abstraction : Base
Description
The product does not implement a required step in a cryptographic algorithm, resulting in weaker
encryption than advertised by the algorithm.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 573 Improper Following of Specification by Caller 1298
PeerOf 358 Improperly Implemented Security Check for Standard 881
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 310 Cryptographic Issues 2318
CWE Version 4.14
CWE-325: Missing Cryptographic Step
CWE-325: Missing Cryptographic Step