1691
product will have the same password, even across different organizations, this enables massive
attacks such as worms to take place.
The Outbound variant applies to front-end systems that authenticate with a back-end service. The
back-end service may require a fixed password which can be easily discovered. The programmer
may simply hard-code those back-end credentials into the front-end product. Any user of that
program may be able to extract the password. Client-side systems with hard-coded passwords
pose even more of a threat, since the extraction of a password from a binary is usually very simple.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 344 Use of Invariant Value in Dynamically Changing Context 849
ChildOf 671 Lack of Administrator Control over Security 1478
ChildOf 1391 Use of Weak Credentials 2269
ParentOf 259 Use of Hard-coded Password 623
ParentOf 321 Use of Hard-coded Cryptographic Key 785
PeerOf 257 Storing Passwords in a Recoverable Format 618
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 287 Improper Authentication 692
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ParentOf 259 Use of Hard-coded Password 623
ParentOf 321 Use of Hard-coded Cryptographic Key 785
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ParentOf 259 Use of Hard-coded Password 623
ParentOf 321 Use of Hard-coded Cryptographic Key 785
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 255 Credentials Management Errors 2315
MemberOf 320 Key Management Errors 2319
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Mobile (Prevalence = Undetermined)
CWE Version 4.14
CWE-798: Use of Hard-coded Credentials
CWE-798: Use of Hard-coded Credentials