Weakness · High
CWE-262: Not Using Password Aging
What it is
The product does not have a mechanism in place for managing password aging.
- Severity (our rating)
- High
- Likelihood of exploit
- Low
- Introduced during
- Architecture and Design
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Password aging (or password rotation) is a policy that forces users to change their passwords after a defined time period passes, such as every 30 or 90 days. Without mechanisms such as aging, users might not change their passwords in a timely manner. Note that while password aging was once considered an important security feature, it has since fallen out of favor by many, because it is not as effective against modern threats compared to other mechanisms such as slow hashes. In addition, forcing frequent changes can unintentionally encourage users to select less-secure passwords. However, password aging is still in use due to factors such as compliance requirements, e.g., Payment Card Industry Data Security Standard (PCI DSS).
What an attacker can do
- Gain Privileges or Assume Identity (Access Control)
How to prevent it
Architecture and Design
- As part of a product's design, require users to change their passwords regularly and avoid reusing previous passwords.
Implementation
- Developers might disable clipboard paste operations into password fields as a way to discourage users from pasting a password into a clipboard. However, this might encourage users to choose less-secure passwords that are easier to type, and it can reduce the usability of password managers.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.