635
Demonstrative Examples
Example 1:
A system does not enforce the changing of passwords every certain period.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 951 SFP Secondary Cluster: Insecure Authentication Policy 888 2396
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Not allowing password aging
Related Attack Patterns
CAPEC-ID Attack Pattern Name
16 Dictionary-based Password Attack
49 Password Brute Forcing
55 Rainbow Table Password Cracking
70 Try Common or Default Usernames and Passwords
509 Kerberoasting
555 Remote Services with Stolen Credentials
560 Use of Known Domain Credentials
561 Windows Admin Shares with Stolen Credentials
565 Password Spraying
600 Credential Stuffing
652 Use of Known Kerberos Credentials
653 Use of Known Operating System Credentials
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1305]Kurt Seifried and other members of the CWE-Research mailing list. "Discussion Thread:
Time to retire CWE-262 and CWE-263". 2021 December 3. < https://www.mail-archive.com/cweresearch-
list@mitre.org/msg00018.html >.2022-10-11.
[REF-1289]Lance Spitzner. "Time for Password Expiration to Die". 2021 June 7. < https://
www.sans.org/blog/time-for-password-expiration-to-die/ >.
[REF-1290]Lorrie Cranor. "Time to rethink mandatory password changes". 2016 March 2. < https://
www.ftc.gov/policy/advocacy-research/tech-at-ftc/2016/03/time-rethink-mandatory-passwordchanges
>.
[REF-1291]Eugene Spafford. "Security Myths and Passwords". 2006 April 9. < https://
www.cerias.purdue.edu/site/blog/post/password-change-myths/ >.
[REF-1292]National Cyber Security Centre. "Password administration for system owners". 2018
November 9. < https://www.ncsc.gov.uk/collection/passwords >.2023-04-07.
CWE Version 4.14
CWE-263: Password Aging with Long Expiration
CWE-263: Password Aging with Long Expiration