623
An empty string should never be used as a password as this can allow unauthorized access to the
application. Username and password information should not be included in a configuration file or a
properties file in clear text. If possible, encrypt this information and avoid CWE-260 and CWE-13.
Observed Examples
Reference Description
CVE-2022-26117 Network access control (NAC) product has a configuration file with an empty
password
https://www.cve.org/CVERecord?id=CVE-2022-26117
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 950 SFP Secondary Cluster: Hardcoded Sensitive Data 888 2396
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Password Management: Empty
Password in Configuration File
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-207]John Viega and Gary McGraw. "Building Secure Software: How to Avoid Security
Problems the Right Way". 1st Edition. 2002. Addison-Wesley.
CWE-259: Use of Hard-coded Password
Weakness ID : 259
Structure : Simple
Abstraction : Variant
Description
The product contains a hard-coded password, which it uses for its own inbound authentication or
for outbound communication to external components.
Extended Description
A hard-coded password typically leads to a significant authentication failure that can be difficult for
the system administrator to detect. Once detected, it can be difficult to fix, so the administrator may
be forced into disabling the product entirely. There are two main variations:
Inbound: the product contains an authentication mechanism that checks for a hard-coded
password.
Outbound: the product connects to another system or component, and it contains hard-coded
password for connecting to that component.
CWE Version 4.14
CWE-259: Use of Hard-coded Password
CWE-259: Use of Hard-coded Password