CWE-549 口令域未进行输入隐藏

Missing Password Field Masking

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The software does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 522 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

范围	影响	注释
Access Control	Bypass Protection Mechanism

可能的缓解方案

['Implementation', 'Requirements']

策略:

Recommendations include requiring all password fields in your web application be masked to prevent other users from seeing this information.

引用

• REF-44 24 Deadly Sins of Software Security

文章来源于互联网:scap中文网