CWE-759: Use of a One-Way Hash without a Salt
low-riskThe product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
Common Consequences
Detection Methods
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Configuration Checker
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Real-World Examples (10)
| CVE | CVSS | EPSS | KEV |
|---|---|---|---|
| CVE-2023-1430 | 6.5 | 1.6% | — |
| CVE-2020-16244 | 7.2 | 0.2% | — |
| CVE-2025-34208 | 7.5 | 0.1% | — |
| CVE-2024-8453 | 4.9 | 0.1% | — |
| CVE-2021-21253 | 5.8 | 0.1% | — |
| CVE-2020-25164 | 6.5 | 0.1% | — |
| CVE-2025-27408 | 4.8 | 0.1% | — |
| CVE-2024-36440 | 6.8 | 0.0% | — |
| CVE-2023-33838 | 4.4 | 0.0% | — |
| CVE-2025-53884 | 5.3 | 0.0% | — |