637
Scope Impact Likelihood
As passwords age, the probability that they are
compromised grows.
Potential Mitigations
Phase: Architecture and Design
Ensure that password aging is limited so that there is a defined maximum age for passwords.
Note that if the expiration window is too short, it can cause users to generate poor or predictable
passwords.
Phase: Architecture and Design
Ensure that the user is notified several times leading up to the password expiration.
Phase: Architecture and Design
Create mechanisms to prevent users from reusing passwords or creating similar passwords.
Phase: Implementation
Developers might disable clipboard paste operations into password fields as a way to discourage
users from pasting a password into a clipboard. However, this might encourage users to choose
less-secure passwords that are easier to type, and it can reduce the usability of password
managers [REF-1294].
Effectiveness = Discouraged Common Practice
Demonstrative Examples
Example 1:
A system requires the changing of passwords every five years.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 951 SFP Secondary Cluster: Insecure Authentication Policy 888 2396
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Allowing password aging
Related Attack Patterns
CAPEC-ID Attack Pattern Name
16 Dictionary-based Password Attack
49 Password Brute Forcing
55 Rainbow Table Password Cracking
70 Try Common or Default Usernames and Passwords
509 Kerberoasting
555 Remote Services with Stolen Credentials
560 Use of Known Domain Credentials
561 Windows Admin Shares with Stolen Credentials
565 Password Spraying
600 Credential Stuffing
652 Use of Known Kerberos Credentials
653 Use of Known Operating System Credentials
CWE Version 4.14
CWE-266: Incorrect Privilege Assignment
CWE-266: Incorrect Privilege Assignment