The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Discouraged | P | 693 | Protection Mechanism Failure |
| ParentOf | Allowed | B | 328 | Use of Weak Hash |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 719 | OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage |
| MemberOf | Prohibited | C | 720 | OWASP Top Ten 2007 Category A9 - Insecure Communications |
| MemberOf | Prohibited | C | 729 | OWASP Top Ten 2004 Category A8 - Insecure Storage |
| MemberOf | Prohibited | C | 816 | OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage |
| MemberOf | Prohibited | C | 934 | OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure |
| MemberOf | Prohibited | C | 959 | SFP Secondary Cluster: Weak Cryptography |
| MemberOf | Prohibited | V | 1003 | Weaknesses for Simplified Mapping of Published Vulnerabilities |
| MemberOf | Prohibited | C | 1013 | Encrypt Data |
| MemberOf | Prohibited | C | 1029 | OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure |
| MemberOf | Prohibited | C | 1346 | OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures |
| MemberOf | Prohibited | C | 1402 | Comprehensive Categorization: Encryption |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-316 | Bypass Protection Mechanism (impact) |
| MemberOf | Prohibited | BS | BOSS-328 | Read Application Data (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1013 | Encrypt Data |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1346 | OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 959 | SFP Secondary Cluster: Weak Cryptography |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Access ControlConfidentiality | N/A | Bypass Protection MechanismRead Application Data | An attacker may be able to decrypt the data using brute force attacks. |
An attacker may be able to decrypt the data using brute force attacks.
Use an encryption scheme that is currently considered to be strong by experts in the field.
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
| Reference | Description |
|---|---|
| CVE-2001-1546 | Weak encryption |
| CVE-2004-2172 | Weak encryption (chosen plaintext attack) |
| CVE-2002-1682 | Weak encryption |
| CVE-2002-1697 | Weak encryption produces same ciphertext from the same plaintext blocks. |
| CVE-2002-1739 | Weak encryption |
| CVE-2005-2281 | Weak encryption scheme |
| CVE-2002-1872 | Weak encryption (XOR) |
| CVE-2002-1910 | Weak encryption (reversible algorithm). |
| CVE-2002-1946 | Weak encryption (one-to-one mapping). |
| CVE-2002-1975 | Encryption error uses fixed salt, simplifying brute force / dictionary attacks (overlaps randomness). |
| Ordinality | Description |
|---|
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
N/A
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| PLOVER | N/A | N/A | Weak Encryption |
| OWASP Top Ten 2007 | A8 | CWE More Specific | Insecure Cryptographic Storage |
| OWASP Top Ten 2007 | A9 | CWE More Specific | Insecure Communications |
| OWASP Top Ten 2004 | A8 | CWE More Specific | Insecure Storage |