COMMON WEAKNESS ENUMERATIONIncomplete

CWE-258

Empty Password in Configuration File

Using an empty string as a password is insecure.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

High

Understand the problem

What is the problem?

Using an empty string as a password is insecure.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Lifecycle phase

Operation

Risk

What does successful exploitation lead to?

Gain Privileges or Assume Identity

Affected security scopes: Access Control

Defence

How is it prevented and fixed?

System Configuration

Secure configuration approach

Detail
Passwords should be at least eight characters long -- the longer the better. Avoid passwords that are in any way similar to other passwords you have. Avoid using words that may be found in a dictionary, names book, on a map, etc. Consider incorporating numbers and/or punctuation into your password. If you do use common words, consider replacing letters in that word with numbers and punctuation. However, do not use "similar-looking" punctuation. For example, it is not a good idea to change cat to c@t, ca+, (@+, or anything similar. Finally, it is never appropriate to use an empty string as a password.