633
This code will run successfully, but anyone who has access to the registry key used to store the
password can read the value of password. If a devious employee has access to this information,
they can use it to break into the system.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 729 OWASP Top Ten 2004 Category A8 - Insecure Storage 711 2338
MemberOf 959 SFP Secondary Cluster: Weak Cryptography 888 2398
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Other
The "crypt" family of functions uses weak cryptographic algorithms and should be avoided. It may
be present in some projects for compatibility.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Password Management: Weak
Cryptography
OWASP Top Ten 2004 A8 CWE More Specific Insecure Storage
Related Attack Patterns
CAPEC-ID Attack Pattern Name
55 Rainbow Table Password Cracking
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-207]John Viega and Gary McGraw. "Building Secure Software: How to Avoid Security
Problems the Right Way". 1st Edition. 2002. Addison-Wesley.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-262: Not Using Password Aging
Weakness ID : 262
Structure : Simple
Abstraction : Base
Description
The product does not have a mechanism in place for managing password aging.
Extended Description
CWE Version 4.14
CWE-262: Not Using Password Aging
CWE-262: Not Using Password Aging