CME-802
Password Quality Enforcement (pwquality)
Description
Enforces minimum password complexity (length, character classes, dictionary checks) via pam_pwquality, making brute force and dictionary attacks impractical.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Password brute force requires significantly more time/resources |
CWE Relationships
Verification
Check pwquality configuration
$ grep -E 'minlen|minclass|dcredit' /etc/security/pwquality.conf
# Expected: minlen = 14
# Expected: minlen = 14
Platform: rhel
$ net accounts | Select-String 'Minimum password length'
# Expected: Minimum password length 14
# Expected: Minimum password length 14
Platform: windows
Applicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| microsoft | windows |
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*
|
All | applicable |