CWE-1472
Weakness AllowedGeneration of Credential with Long Expiration
Abstraction: Base · Status: Incomplete
The product generates or relies on a credential such as a key, certificate, password, confirmation code, or token, but the credential does not expire or has an expiration that is too long, i.e., the expiration is insufficient for the intended security policy of the product.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Detection methods
Automated Dynamic Analysis
If the credentials are provided through a communications protocol, monitor the communications related to credential generation and examine any expiration dates or times that are set.
Manual Analysis
Examine the code to determine where credentials are created or updated, and determine how any expiration dates or times are set.
Content history
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
For each credential that is created, reset, or used, ensure that the expiration is set to be as short as possible while preserving usability.
Mitigation
Design the product to analyze the credentials that it manages, and provide mechanisms to provide secure defaults, and/or a capability to warn users about excessive expiration.
No CAPEC attack patterns related to this CWE.