1813
References
[REF-885]Stefan Esser. "Shocking News in PHP Exploitation". 2009. < https://owasp.org/www-pdfarchive/
POC2009-ShockingNewsInPHPExploitation.pdf >.2023-04-07.
[REF-886]Dinis Cruz. ""Two Security Vulnerabilities in the Spring Framework's MVC" pdf (from
2008)". < http://diniscruz.blogspot.com/2011/07/two-security-vulnerabilities-in-spring.html
>.2023-04-07.
[REF-887]Ryan Berg and Dinis Cruz. "Two Security Vulnerabilities in the Spring Framework's
MVC". < https://o2platform.files.wordpress.com/2011/07/ounce_springframework_vulnerabilities.pdf
>.2023-04-07.
[REF-888]ASPNETUE. "Best Practices for ASP.NET MVC". 2010 September 7. < https://
web.archive.org/web/20100921074010/http://blogs.msdn.com/b/aspnetue/archive/2010/09/17/
second_2d00_post.aspx >.2023-04-07.
[REF-889]Michael Hartl. "Mass assignment in Rails applications". 2008 September 1. < https://
web.archive.org/web/20090808163156/http://blog.mhartl.com/2008/09/21/mass-assignment-inrails-
applications/ >.2023-04-07.
[REF-890]Tobi. "Secure your Rails apps!". 2012 March 6. < https://
pragtob.wordpress.com/2012/03/06/secure-your-rails-apps/ >.2023-04-07.
[REF-891]Heiko Webers. "Ruby On Rails Security Guide". < https://guides.rubyonrails.org/
security.html#mass-assignment >.2023-04-07.
[REF-892]Josh Bush. "Mass Assignment Vulnerability in ASP.NET MVC". 2012 March 5. < https://
web.archive.org/web/20120309022539/http://freshbrewedcode.com/joshbush/2012/03/05/massassignment-
aspnet-mvc >.2023-04-07.
[REF-893]K. Scott Allen. "6 Ways To Avoid Mass Assignment in ASP.NET MVC". 2012 March 2. <
https://odetocode.com/blogs/scott/archive/2012/03/11/complete-guide-to-mass-assignment-in-aspnet-
mvc.aspx >.2023-04-07.
[REF-894]Egidio Romano. "PHP Object Injection". 2013 January 2. < https://owasp.org/wwwcommunity/
vulnerabilities/PHP_Object_Injection >.2023-04-07.
[REF-464]Heine Deelstra. "Unserializing user-supplied data, a bad idea". 2010 August 5. < https://
drupalsun.com/heine/2010/08/25/unserializing-user-supplied-data-bad-idea >.2023-04-07.
[REF-466]Nadia Alramli. "Why Python Pickle is Insecure". 2009 September 9. < http://michaelrushanan.
blogspot.com/2012/10/why-python-pickle-is-insecure.html >.2023-04-07.
CWE-916: Use of Password Hash With Insufficient Computational Effort
Weakness ID : 916
Structure : Simple
Abstraction : Base
Description
The product generates a hash for a password, but it uses a scheme that does not provide a
sufficient level of computational effort that would make password cracking attacks infeasible or
expensive.
Extended Description
Many password storage mechanisms compute a hash and store the hash, instead of storing
the original password in plaintext. In this design, authentication involves accepting an incoming
password, computing its hash, and comparing it to the stored hash.
CWE Version 4.14
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-916: Use of Password Hash With Insufficient Computational Effort