The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Extended Description
An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.
Time of Introduction
Architecture and Design
Implementation
Common Consequences
Scope
Effect
Access Control
Technical Impact: Gain privileges / assume
identity
An attacker could easily guess user passwords and gain access user
accounts.
Potential Mitigations
Phase: Architecture and Design
Enforce usage of strong passwords. A password strength policy should
contain the following attributes:
Minimum and maximum length;
Require mixed character sets (alpha, numeric, special, mixed
case);
Do not contain user name;
Expiration;
No password reuse.
Phase: Architecture and Design
Authentication mechanisms should always require sufficiently complex
passwords and require that they be periodically changed.
[REF-17] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 19: Use of Weak Password-Based Systems." Page
279. McGraw-Hill. 2010.
Description
