810
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 934 OWASP Top Ten 2013 Category A6 - Sensitive Data
Exposure
928 2391
MemberOf 958 SFP Secondary Cluster: Broken Cryptography 888 2398
MemberOf 1029 OWASP Top Ten 2017 Category A3 - Sensitive Data
Exposure
1026 2436
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Maintenance
Since CWE 4.4, various cryptography-related entries including CWE-328 have been slated for
extensive research, analysis, and community consultation to define consistent terminology,
improve relationships, and reduce overlap or duplication. As of CWE 4.6, this work is still
ongoing.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Reversible One-Way Hash
Related Attack Patterns
CAPEC-ID Attack Pattern Name
68 Subvert Code-signing Facilities
461 Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
References
[REF-289]Alexander Sotirov et al.. "MD5 considered harmful today". < http://www.phreedom.org/
research/rogue-ca/ >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-291]Johnny Shelley. "bcrypt". < http://bcrypt.sourceforge.net/ >.
[REF-292]Colin Percival. "Tarsnap - The scrypt key derivation function and encryption utility". <
http://www.tarsnap.com/scrypt.html >.
[REF-293]B. Kaliski. "RFC2898 - PKCS #5: Password-Based Cryptography Specification Version
2.0". 2000. < https://www.rfc-editor.org/rfc/rfc2898 >.2023-04-07.
[REF-294]Coda Hale. "How To Safely Store A Password". 2010 January 1. < https://codahale.com/
how-to-safely-store-a-password/ >.2023-04-07.
[REF-295]Brian Krebs. "How Companies Can Beef Up Password Security (interview with Thomas
H. Ptacek)". 2012 June 1. < https://krebsonsecurity.com/2012/06/how-companies-can-beef-uppassword-
security/ >.2023-04-07.
[REF-296]Solar Designer. "Password security: past, present, future". 2012. < https://
www.openwall.com/presentations/PHDays2012-Password-Security/ >.2023-04-07.
[REF-297]Troy Hunt. "Our password hashing has no clothes". 2012 June 6. < https://
www.troyhunt.com/our-password-hashing-has-no-clothes/ >.2023-04-07.
CWE Version 4.14
CWE-329: Generation of Predictable IV with CBC Mode
CWE-329: Generation of Predictable IV with CBC Mode