Cyber Resilience

CWE · MITRE source

CWE-549Missing Password Field Masking

Abstraction: Base · CVEs in our corpus: 16

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 1 mapping(s) from 1 framework(s): ASVS 5.0 1 (full)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (1)AI

Control Title Family Why it addresses this CWE
IA-6Authentication FeedbackIAObscuring feedback includes masking password input (e.g., asterisks), which addresses the weakness of missing password field masking.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1056 Input Capture→P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-225503.56.70.00222022-04-12
CVE-2022-13423.54.60.00382022-06-15
CVE-2022-209143.54.90.00802022-08-10
CVE-2023-17633.56.50.00282023-05-17
CVE-2023-20623.56.20.00332023-06-02
CVE-2023-491063.54.60.00442024-01-16
CVE-2025-317273.55.50.00272025-04-02
CVE-2025-317283.55.50.00272025-04-02
CVE-2025-4526 UPD3.54.30.00232025-05-11
CVE-2025-429043.56.50.00282025-12-09
CVE-2026-3314 UPD3.54.60.00182026-05-26
CVE-2024-101221.52.70.00482024-10-18
CVE-2025-01481.52.60.00172025-02-03
CVE-2025-301971.53.10.00262025-03-19
CVE-2025-641701.53.80.00122025-11-12