DerScanner
Home / Vulnerability Database / Objective-C : Null password
Objective-C

Objective-C : Null password

Classification

OWASP Mobile Top 10 2014
M2-Insecure Data StorageM5-Poor Authorization and Authentication
OWASP Mobile Top 10 2016
M4-Insecure Authentication
OWASP Top 10 2021
A4-Insecure Design
OWASP ASVS
AuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthentication
PCI DSS 4.0
6.2.48.3.2
HIPAA
§164.312 (a)(1)
CWE
CWE-257CWE-259CWE-522
CWE/SANS Top 25 2021
CWE-522

Overview

Password with a value of nil can result in an application compromise.

Assigning nil to password variables can allow attackers to bypass password verification or might indicate that resources are protected by an empty password.

In case of a mobile application, authentication systems must take into account the probability of device loss.

References

  1. CWE-259: Use of Hard-coded Password
  2. OWASP Top 10 2013-A5-Security Misconfiguration
  3. OWASP Top 10 2013-A6-Sensitive Data Exposure
  4. OWASP Mobile Top 10 2016-M4-Insecure Authentication
LOW

DerScanner Severity Score

Do you want to fix Objective-C : Null password in your application?

See also

Objective-C

Objective-C : Internal information leak

Objective-C

Objective-C : Weak hashing algorithm

Objective-C

Objective-C : Unsafe reflection