628
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 753 2009 Top 25 - Porous Defenses 750 2353
MemberOf 861 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 18 - Miscellaneous (MSC)
844 2370
MemberOf 950 SFP Secondary Cluster: Hardcoded Sensitive Data 888 2396
MemberOf 1152 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 49. Miscellaneous (MSC)
1133 2453
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
This entry could be split into multiple variants: an inbound variant (as seen in the second
demonstrative example) and an outbound variant (as seen in the first demonstrative example).
These variants are likely to have different consequences, detectability, etc. More importantly,
from a vulnerability theory perspective, they could be characterized as different behaviors.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Password Management: Hard-Coded
Password
CLASP Use of hard-coded password
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC03-J Never hard code sensitive information
Software Fault Patterns SFP33 Hardcoded sensitive data
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
[REF-1288]Julia Lokrantz. "Ethical hacking of a Smart Automatic Feed Dispenser". 2021 June 7. <
http://kth.diva-portal.org/smash/get/diva2:1561552/FULLTEXT01.pdf >.
[REF-1304]ICS-CERT. "ICS Alert (ICS-ALERT-13-164-01): Medical Devices Hard-Coded
Passwords". 2013 June 3. < https://www.cisa.gov/news-events/ics-alerts/ics-alert-13-164-01
>.2023-04-07.
CWE Version 4.14
CWE-260: Password in Configuration File
CWE-260: Password in Configuration File