804
Reference Description
https://www.cve.org/CVERecord?id=CVE-2008-3188
CVE-2005-2946 Default configuration of product uses MD5 instead of stronger algorithms that
are available, simplifying forgery of certificates.
https://www.cve.org/CVERecord?id=CVE-2005-2946
CVE-2007-6013 Product uses the hash of a hash for authentication, allowing attackers to gain
privileges if they can obtain the original hash.
https://www.cve.org/CVERecord?id=CVE-2007-6013
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 729 OWASP Top Ten 2004 Category A8 - Insecure Storage 711 2338
MemberOf 753 2009 Top 25 - Porous Defenses 750 2353
MemberOf 803 2010 Top 25 - Porous Defenses 800 2355
MemberOf 816 OWASP Top Ten 2010 Category A7 - Insecure
Cryptographic Storage
809 2359
MemberOf 866 2011 Top 25 - Porous Defenses 900 2372
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
MemberOf 884 CWE Cross-section 884 2567
MemberOf 934 OWASP Top Ten 2013 Category A6 - Sensitive Data
Exposure
928 2391
MemberOf 958 SFP Secondary Cluster: Broken Cryptography 888 2398
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1029 OWASP Top Ten 2017 Category A3 - Sensitive Data
Exposure
1026 2436
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1152 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 49. Miscellaneous (MSC)
1133 2453
MemberOf 1170 SEI CERT C Coding Standard - Guidelines 48.
Miscellaneous (MSC)
1154 2463
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Maintenance
Since CWE 4.4, various cryptography-related entries, including CWE-327 and CWE-1240, have
been slated for extensive research, analysis, and community consultation to define consistent
terminology, improve relationships, and reduce overlap or duplication. As of CWE 4.6, this work
is still ongoing.
Maintenance
The Taxonomy_Mappings to ISA/IEC 62443 were added in CWE 4.10, but they are still under
review and might change in future CWE versions. These draft mappings were performed by
members of the "Mapping CWE to 62443" subgroup of the CWE-CAPEC ICS/OT Special Interest
Group (SIG), and their work is incomplete as of CWE 4.10. The mappings are included to
CWE Version 4.14
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-327: Use of a Broken or Risky Cryptographic Algorithm