Check: APSC-DV-003280
Application Security and Development STIG:
APSC-DV-003280
(in versions v5 r3 through v4 r2)
Title
Default passwords must be changed. (Cat I impact)
Discussion
Default passwords can easily be compromised by attackers allowing immediate access to the applications.
Check Content
Identify the application name and version and do an Internet search for the product name and the string "default password". If default passwords are found, attempt to authenticate with the published default passwords. If authentication is successful, this is a finding.
Fix Text
Configure the application to use strong authenticators instead of passwords when possible. Otherwise, change default passwords to a DoD-approved strength password and follow all guidance for passwords.
Additional Identifiers
Rule ID: SV-222662r879887_rule
Vulnerability ID: V-222662
Group Title: SRG-APP-000516
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-003109 |
The organization requires the developer of the information system, system component, or information system service to deliver the system, component, or service with organization-defined security configurations implemented. |