V5326. OWASP. A password for a database connection should not be empty

The analyzer has detected that an empty password was used when connecting to a database. The empty password lacks basic security, which can lead to unauthorized data access.

This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:

• A07:2021 – Identification and Authentication Failures.

The example of an insecure configuration:

var dataSource = new PGSimpleDataSource();
dataSource.setDatabaseName("db");
dataSource.setUser("server");
dataSource.setPassword("");
// ....

Access parameters in the workspace should fulfill the following requirements:

• Use strong and unpredictable passwords that cannot be compromised through brute force attacks. They should be at least eight characters long and include a mix of uppercase and lowercase letters, numbers, and symbols.
• Grant only the necessary permissions to credential holders. For example, do not provide the write permissions if access is required for reading data only.
• Avoid storing access parameters in code. Instead, use properties, configuration classes, or environment variables.

The fixed code:

var dataSource = new PGSimpleDataSource();
dataSource.setDatabaseName("db");
dataSource.setUser(System.getProperty("db.user"));
dataSource.setPassword(System.getProperty("db.password"));
// ....

This diagnostic is classified as:

Was this page helpful?

Message submitted.

Your message has been sent. We will email you at

If you do not see the email in your inbox, please check if it is filtered to one of the following folders:

• Promotion
• Updates
• Spam

If you can’t find an answer to your question, fill in the form below and our developers will contact you

By clicking this button you agree to our Privacy Policy statement