CME-805
Credential Rotation Policy
Description
Automated rotation of secrets, API keys, and passwords on schedule. Limits the window during which compromised credentials remain valid.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Compromised credentials expire before attacker can use them |
CWE Relationships
Verification
Check password aging and secret rotation policies
$ chage -l <user> | grep 'Maximum'
# Expected: Maximum number of days between password change : 90
# Expected: Maximum number of days between password change : 90
Platform: linux
$ net accounts | Select-String 'Maximum password age'
# Expected: Maximum password age (days) 90
# Expected: Maximum password age (days) 90
Platform: windows
Applicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| microsoft | windows |
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*
|
All | applicable |