CWE-549: Missing Password Field Masking
Description
The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access Control
Bypass Protection Mechanism
Potential mitigations
- ImplementationRequirements
Recommendations include requiring all password fields in your web application be masked to prevent other users from seeing this information.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.