The software does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
Time of Introduction
Implementation
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism
Potential Mitigations
Phases: Implementation; Requirements
Recommendations include requiring all password fields in your web
application be masked to prevent other users from seeing this
information.
Other Notes
Basic web application security measures include masking all passwords
entered by a user when logging in to a web application. Normally, each
character in a password entered by a user is instead represented with an
asterisk.
[REF-17] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 19: Use of Weak Password-Based Systems." Page
279. McGraw-Hill. 2010.
Description
