1817
Reference Description
CVE-2006-1058 Router does not use a salt with a hash, making it easier to crack passwords.
https://www.cve.org/CVERecord?id=CVE-2006-1058
CVE-2008-4905 Blogging software uses a hard-coded salt when calculating a password hash.
https://www.cve.org/CVERecord?id=CVE-2008-4905
CVE-2002-1657 Database server uses the username for a salt when encrypting passwords,
simplifying brute force attacks.
https://www.cve.org/CVERecord?id=CVE-2002-1657
CVE-2001-0967 Server uses a constant salt when encrypting passwords, simplifying brute force
attacks.
https://www.cve.org/CVERecord?id=CVE-2001-0967
CVE-2005-0408 chain: product generates predictable MD5 hashes using a constant value
combined with username, allowing authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2005-0408
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Related Attack Patterns
CAPEC-ID Attack Pattern Name
55 Rainbow Table Password Cracking
References
[REF-291]Johnny Shelley. "bcrypt". < http://bcrypt.sourceforge.net/ >.
[REF-292]Colin Percival. "Tarsnap - The scrypt key derivation function and encryption utility". <
http://www.tarsnap.com/scrypt.html >.
[REF-293]B. Kaliski. "RFC2898 - PKCS #5: Password-Based Cryptography Specification Version
2.0". 2000. < https://www.rfc-editor.org/rfc/rfc2898 >.2023-04-07.
[REF-294]Coda Hale. "How To Safely Store A Password". 2010 January 1. < https://codahale.com/
how-to-safely-store-a-password/ >.2023-04-07.
[REF-295]Brian Krebs. "How Companies Can Beef Up Password Security (interview with Thomas
H. Ptacek)". 2012 June 1. < https://krebsonsecurity.com/2012/06/how-companies-can-beef-uppassword-
security/ >.2023-04-07.
[REF-296]Solar Designer. "Password security: past, present, future". 2012. < https://
www.openwall.com/presentations/PHDays2012-Password-Security/ >.2023-04-07.
[REF-297]Troy Hunt. "Our password hashing has no clothes". 2012 June 6. < https://
www.troyhunt.com/our-password-hashing-has-no-clothes/ >.2023-04-07.
[REF-298]Joshbw. "Should we really use bcrypt/scrypt?". 2012 June 8. < https://web.archive.org/
web/20120629144851/http://www.analyticalengine.net/2012/06/should-we-really-use-bcryptscrypt/
>.2023-04-07.
[REF-636]Jeff Atwood. "Speed Hashing". 2012 April 6. < https://blog.codinghorror.com/speedhashing/
>.2023-04-07.
[REF-631]OWASP. "Password Storage Cheat Sheet". < https://cheatsheetseries.owasp.org/
cheatsheets/Password_Storage_Cheat_Sheet.html >.2023-04-07.
CWE Version 4.14
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement
('Expression Language Injection')
CWE-917: Improper Neutralization of Special Elements used in an
Expression Language Statement ('Expression Language Injection') 1818
[REF-632]Thomas Ptacek. "Enough With The Rainbow Tables: What You Need To Know About
Secure Password Schemes". 2007 September 0. < http://hashphp.org/hashing.html >.2023-04-07.
[REF-908]Solar Designer. "Password hashing at scale". 2012 October 1. < https://
www.openwall.com/presentations/YaC2012-Password-Hashing-At-Scale/ >.2023-04-07.
[REF-909]Solar Designer. "New developments in password hashing: ROM-port-hard functions".
2012 November. < https://www.openwall.com/presentations/ZeroNights2012-New-In-Password-
Hashing/ >.2023-04-07.
[REF-633]Robert Graham. "The Importance of Being Canonical". 2009 February 2. < https://
blog.erratasec.com/2009/02/importance-of-being-canonical.html#.ZCbyY7LMJPY >.2023-04-07.
CWE-917: Improper Neutralization of Special Elements used in an Expression
Language Statement ('Expression Language Injection')
Weakness ID : 917
Structure : Simple
Abstraction : Base
Description
The product constructs all or part of an expression language (EL) statement in a framework such
as a Java Server Page (JSP) using externally-influenced input from an upstream component, but
it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL
statement before it is executed.
Extended Description
Frameworks such as Java Server Page (JSP) allow a developer to insert executable expressions
within otherwise-static content. When the developer is not aware of the executable nature of these
expressions and/or does not disable them, then if an attacker can inject expressions, this could
lead to code execution or other unexpected behaviors.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 77 Improper Neutralization of Special Elements used in a
Command ('Command Injection')