Falhas do tipo CWE-759

18 resultados

Uso de hash unidirecional sem sal

A fraqueza ocorre quando senhas ou dados sensíveis são criptografados com funções hash (como MD5 ou SHA1) sem adicionar um sal aleatório único. Sem o sal, dois usuários com a mesma senha geram o mesmo hash, e atacantes podem usar tabelas pré-computadas (rainbow tables) para recuperar a senha original em segundos.

Exemplo

Um sistema armazena senha como hash_md5(senha) sem sal. Atacante obtém o banco de dados, coloca o hash em um site de busca de rainbow tables e descobre a senha em minutos. Se outro usuário tinha a mesma senha, ambos são comprometidos com o mesmo hash.

Como mitigar

Use funções modernas de derivação de chave (bcrypt, Argon2, PBKDF2) que incorporam sal automaticamente e são computacionalmente caras. Nunca use MD5 ou SHA1 para senhas; se encontrar código assim, refatore imediatamente.

CVE-2023-1430MEDIUMFluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization ControlEPSS 0.8%CVE-2021-21253MEDIUMUse of a One-Way Hash without a Salt in OnlineVotingSystemEPSS 0.7%CVE-2020-16244—GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords.EPSS 0.7%CVE-2020-25164MEDIUMB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusEPSS 0.6%CVE-2025-34208HIGHVasion Print (formerly PrinterLogic) Insecure Password HashingEPSS 0.4%CVE-2024-8453MEDIUMPLANET Technology switch devices - Weak hash for users' passwordsEPSS 0.3%CVE-2024-36440MEDIUMAn issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administEPSS 0.3%CVE-2023-33838MEDIUMIBM Security Verify Governance information disclosureEPSS 0.2%CVE-2025-36253MEDIUMMultiple Vulnerabilities in IBM Concert Software.EPSS 0.2%CVE-2026-9370MEDIUMulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable saltEPSS 0.2%CVE-2025-10205HIGHPredictable Salt and Weak Hashing AlgorithmEPSS 0.2%CVE-2025-53884MEDIUMNeuVector has an insecure password storage vulnerable to rainbow attackEPSS 0.2%CVE-2025-27408MEDIUMManifest Uses a One-Way Hash without a SaltEPSS 0.2%CVE-2026-45027MEDIUMWeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.phpEPSS 0.1%CVE-2025-15544MEDIUMWeak Credential Protection During TP-Link Omada Device AdoptionEPSS 0.1%CVE-2026-45787MEDIUMelecterm's encrypt method not safe enoughEPSS 0.1%CVE-2025-15631MEDIUMWeak Credential Storage in TP-Link Omada DevicesEPSS 0.1%CVE-2025-5922MEDIUMRetrievable password hash protecting TSplus admin consoleEPSS 0.1%