CWE-258Empty Password in Configuration File

Abstraction: Variant · CVEs in our corpus: 10

Using an empty string as a password is insecure.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 6 mapping(s) from 3 framework(s): STIG oracle linux 8 2 (full) · STIG oracle linux 9 2 (mostly) · STIG rhel 7 2 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.AA-03
PR.PS-01
IA-5 Authenticator Management
IA-2 Identification and Authentication (Organizational Users)

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

6 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-5021`	8.0	9.8	0.0626	2019-05-08
`CVE-2018-17914`	7.9	9.8	0.0457	2018-11-02
`CVE-2025-9276`	7.4	9.8	0.0065	2025-09-02
`CVE-2023-39439`	6.7	8.8	0.0071	2023-08-08
`CVE-2024-28744`	6.5	8.8	0.0030	2024-04-08
`CVE-2020-29478`	6.1	7.5	0.0117	2021-01-05
`CVE-2023-43016`	5.8	7.3	0.0071	2024-02-03
`CVE-2025-4395`	5.1	6.8	0.0027	2025-07-24
`CVE-2024-35137`	4.8	6.2	0.0026	2024-06-28
`CVE-2024-4106`	4.4	5.3	0.0039	2024-06-26