CWE-549 口令域未进行输入隐藏
Missing Password Field Masking
结构: Simple
Abstraction: Variant
状态: Draft
被利用可能性: unkown
基本描述
The software does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
相关缺陷
- cwe_Nature: ChildOf cwe_CWE_ID: 522 cwe_View_ID: 1000 cwe_Ordinal: Primary
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Access Control | Bypass Protection Mechanism |
可能的缓解方案
['Implementation', 'Requirements']
策略:
Recommendations include requiring all password fields in your web application be masked to prevent other users from seeing this information.