CVE-2022-3754 (published 2022-10-29T13:15Z)

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-521
cwe_name: Weak Password Requirements
description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
extended_description: Authentication mechanisms often rely on a memorized secret (also known as a password) to provide an assertion of identity for a user of a system. It is therefore important that this password be of sufficient complexity and impractical for an adversary to guess. The specific requirements around how complex a password needs to be depends on the type of system being protected. Selecting the correct password requirements and enforcing them through implementation are critical to the overall success of the authentication mechanism.
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2022-10-21 12:48:47+02:00
msg: fix: check for at least 8 characters for a password
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: pwd.change.php
change_type: ModificationType.MODIFY
diff: @@ -53,22 +53,29 @@ if ($user->perm->hasPermission($user->getUserId(), 'passwd')) {
         $newPassword = Filter::filterInput(INPUT_POST, 'npass', FILTER_UNSAFE_RAW);
         $retypedPassword = Filter::filterInput(INPUT_POST, 'bpass', FILTER_UNSAFE_RAW);
 
-        if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
-            if (!$user->changePassword($newPassword)) {
+        if (strlen($newPassword) <= 7 || strlen($retypedPassword) <= 7) {
+            printf(
+                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
+                $PMF_LANG['ad_passwd_fail']
+            );
+        } else {
+            if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
+                if (!$user->changePassword($newPassword)) {
+                    printf(
+                        '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
+                        $PMF_LANG['ad_passwd_fail']
+                    );
+                }
+                printf(
+                    '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
+                    $PMF_LANG['ad_passwdsuc']
+                );
+            } else {
                 printf(
                     '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                     $PMF_LANG['ad_passwd_fail']
                 );
             }
-            printf(
-                '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
-                $PMF_LANG['ad_passwdsuc']
-            );
-        } else {
-            printf(
-                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
-                $PMF_LANG['ad_passwd_fail']
-            );
         }
     }
     ?>

programming_language: PHP
filename: Installer.php
change_type: ModificationType.MODIFY
diff: @@ -845,14 +845,14 @@ class Installer
             $esSetup = [];
         }
 
-        // check loginname
+        // check login name
         if (!isset($setup['loginname'])) {
             $loginName = Filter::filterInput(INPUT_POST, 'loginname', FILTER_UNSAFE_RAW);
         } else {
             $loginName = $setup['loginname'];
         }
         if (is_null($loginName)) {
-            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a loginname for your account.</p>';
+            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a login name for your account.</p>';
             System::renderFooter(true);
         }
 
@@ -863,8 +863,7 @@ class Installer
             $password = $setup['password'];
         }
         if (is_null($password)) {
-            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for the your ' .
-                'account.</p>';
+            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for your account.</p>';
             System::renderFooter(true);
         }
 
@@ -873,16 +872,18 @@ class Installer
         } else {
             $passwordRetyped = $setup['password_retyped'];
         }
+
         if (is_null($passwordRetyped)) {
             echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a retyped password.</p>';
             System::renderFooter(true);
         }
 
-        if (strlen($password) <= 5 || strlen($passwordRetyped) <= 5) {
+        if (strlen($password) <= 7 || strlen($passwordRetyped) <= 7) {
             echo '<p class="alert alert-danger"><strong>Error:</strong> Your password and retyped password are too ' .
                 'short. Please set your password and your retyped password with a minimum of 6 characters.</p>';
             System::renderFooter(true);
         }
+
         if ($password != $passwordRetyped) {
             echo '<p class="alert alert-danger"><strong>Error:</strong> Your password and retyped password are not ' .
                 'equal. Please check your password and your retyped password.</p>';

programming_language: PHP