CWE-916Use of Password Hash With Insufficient Computational Effort

Description

Common consequences· 1

• Access Control — Bypass Protection Mechanism, Gain Privileges or Assume Identity
  If an attacker can gain access to the hashes, then the lack of sufficient computational effort will make it easier to conduct brute force attacks using techniques such as rainbow tables, or specialized hardware such as GPUs, which can be much faster than general-purpose CPUs for computing hashes.

Potential mitigations· 2

• [Architecture and Design]
• [Implementation, Architecture and Design]When using industry-approved techniques, use them correctly. Don't cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.

Related CAPEC attack patterns· 1

Exploits (incoming)1

(incoming)3

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.