1223
Nature Type ID Name Page
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE-521: Weak Password Requirements
Weakness ID : 521
Structure : Simple
Abstraction : Base
Description
The product does not require that users should have strong passwords, which makes it easier for
attackers to compromise user accounts.
Extended Description
Authentication mechanisms often rely on a memorized secret (also known as a password) to
provide an assertion of identity for a user of a system. It is therefore important that this password
be of sufficient complexity and impractical for an adversary to guess. The specific requirements
around how complex a password needs to be depends on the type of system being protected.
Selecting the correct password requirements and enforcing them through implementation are
critical to the overall success of the authentication mechanism.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1391 Use of Weak Credentials 2269
ParentOf 258 Empty Password in Configuration File 621
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 287 Improper Authentication 692
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 255 Credentials Management Errors 2315
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
CWE Version 4.14
CWE-521: Weak Password Requirements
CWE-521: Weak Password Requirements