Description
The product does not require that users should have strong passwords.
Potential Impact
Access Control
Gain Privileges or Assume Identity
Mitigations & Prevention
A product's design should require adherance to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes: Depending on the threat model, the password policy may include several additional attributes. See NIST 800-63B [REF-1053] for further information on password requirements.
Consider a second authentication factor beyond the password, which prevents the password from being a single point of failure. See CWE-308 for further information.
Consider implementing a password complexity meter to inform users when a chosen password meets the required attributes.
Previously, "password expiration" was widely advocated as a defense-in-depth approach to minimize the risk of weak passwords, and it has become a common practice. Password expiration requires a password to be changed within a fixed time window (such as every 90 days). However, this approach has significant limitations in the current threat landscape, and its utility has been reduced in light of the adoption of related protection mechanisms (such
Detection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2020-4574 | key server application does not require strong passwords |
Related Weaknesses
Taxonomy Mappings
- OWASP Top Ten 2004: A3 — Broken Authentication and Session Management
Frequently Asked Questions
What is CWE-521?
CWE-521 (Weak Password Requirements) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not require that users should have strong passwords.
How can CWE-521 be exploited?
Attackers can exploit CWE-521 (Weak Password Requirements) to gain privileges or assume identity. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-521?
Key mitigations include: A product's design should require adherance to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attr
What is the severity of CWE-521?
CWE-521 is classified as a Base-level weakness (Medium abstraction). It has been observed in 1 real-world CVEs.