cve.bz

CWE-521: Weak Password Requirements, page 3

Filter

The product does not require that users should have strong passwords.

What the weakness is: CWE-521 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 9
  • CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
  • CAPEC-55 Rainbow Table Password Cracking Likelihood: Medium · Severity: Medium
  • CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
  • CAPEC-112 Brute Force Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-565 Password Spraying Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-521, as MITRE names them. Credits.

Ask an AI about CWE-521

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-521: Weak Password Requirements and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/521.html and https://cve.bz/cve/cwe/521?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2023-7053EPSS 0.8%

    A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The a…

  2. 9.8CVE-2023-24049EPSS 0.9%

    An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management.

  3. 9.8CVE-2023-29974EPSS 1.8%

    An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.

  4. 8.8CVE-2023-41353EPSS 0.7%

    Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin a…

  5. 9.8CVE-2023-37503EPSS 0.5%

    HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.

  6. 9.8CVE-2023-37756EPSS 1.4%

    I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.

  7. 7.5CVE-2023-40707EPSS 0.6%

    There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.

  8. 8.8CVE-2023-4125EPSS 0.9%

    Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.

  9. 9.8CVE-2023-34995EPSS 0.6%

    There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.

  10. 7.5CVE-2023-3089EPSS 0.5%

    A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

  11. 9.8CVE-2023-34240EPSS 0.5%

    Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of c…

  12. 8.8CVE-2023-3423EPSS 0.8%

    Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0.

  13. 7.5CVE-2023-2060EPSS 0.8%

    Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to a…

  14. 9.8CVE-2023-31098EPSS 1.2%

    Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0.  When users change their password to a simple password (with any character or symbol), attack…

  15. 7.5CVE-2023-25184EPSS 1.0%

    Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge …

  16. 7.5CVE-2023-25072EPSS 0.8%

    Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product.

  17. 7.5CVE-2023-31043EPSS 0.4%

    EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_c…

  18. 9.8CVE-2023-2160EPSS 0.6%

    Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.

  19. 6.5CVE-2023-24502EPSS 0.2%

    Electra Central AC unit – The unit opens an AP with an easily calculated password.

  20. 9.8CVE-2023-2106EPSS 0.7%

    Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.

  21. 7.5CVE-2022-34333EPSS 0.6%

    IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 229698.

  22. 9.8CVE-2023-1753EPSS 0.7%

    Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

  23. 7.5CVE-2022-45635EPSS 0.8%

    An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy.

  24. 5.5CVE-2021-36689EPSS 0.3%

    An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decrypt data via a brute force attack that uses a recovered samourai.dat file. The P…

  25. 8.8CVE-2023-0793EPSS 0.7%

    Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.

  26. 9.1CVE-2023-0641EPSS 1.0%

    A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file changepassword.php. The manipulation of the argument…

  27. 9.8CVE-2022-32513EPSS 0.7%

    A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Version…

  28. 6.5CVE-2023-0569EPSS 0.7%

    Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.

  29. 7.5CVE-2023-0564EPSS 0.5%

    Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.

  30. 9.8CVE-2023-0307EPSS 0.7%

    Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

  31. 8.8CVE-2023-22451EPSS 0.7%

    Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This …

  32. 9.8CVE-2022-44236EPSS 0.8%

    Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.

  33. 7.5CVE-2021-39434EPSS 0.6%

    A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220.

  34. 9.8CVE-2022-45482EPSS 1.4%

    Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H…

  35. 2.7CVE-2022-41969EPSS 0.9%

    Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against th…

  36. 7.2CVE-2022-43030EPSS 3.8%

    Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can…

  37. 9.8CVE-2022-3754EPSS 1.6%

    Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

  38. 5.3CVE-2022-3376EPSS 0.8%

    Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.

  39. 4.3CVE-2022-3326EPSS 0.7%

    Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.

  40. 9.8CVE-2022-3268EPSS 1.4%

    Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.

  41. 8.8CVE-2022-3179EPSS 1.0%

    Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.

  42. 7.5CVE-2022-27558EPSS 0.6%

    HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.

  43. 9.8CVE-2022-37158EPSS 1.0%

    RuoYi v3.8.3 has a Weak password vulnerability in the management system.

  44. 8.8CVE-2022-34772EPSS 0.5%

    Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting.

  45. 9.8CVE-2022-2927EPSS 0.9%

    Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.

  46. 9.8CVE-2022-34615EPSS 1.6%

    Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.

  47. 9.8CVE-2022-35280EPSS 0.8%

    IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.

  48. 9.8CVE-2022-35143EPSS 1.7%

    Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.

  49. 7.5CVE-2022-36301EPSS 1.0%

    BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password.

  50. 8.8CVE-2022-26117EPSS 1.0%

    An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authentic…