Rule Definition
Using insecure parameters for this encoder could expose users to brute-force and other types of attacks.

Remediation
Always use recommended parameters.

Violation Code Sample

final int iterationsKO1 = 1000;
final int hashWidthKO1 = 31;
PasswordEncoder pe = new Pbkdf2PasswordEncoder(pbkdfSecret, iterationsKO1, hashWidthKO1); // insecure parameters

Fixed Code Sample

PasswordEncoder pe = new Pbkdf2PasswordEncoder(pbkdfSecret); // OK

// Other solution:
final int iterationsOK1 = 10000;
final int hashWidthOK1 = 32;
PasswordEncoder pe = new Pbkdf2PasswordEncoder(pbkdfSecret, iterationsOK1, hashWidthOK1); // OK

CWE-916: Use of Password Hash With Insufficient Computational Effort https://cwe.mitre.org/data/definitions/916.html CWE-522: Insufficiently Protected Credentials https://cwe.mitre.org/data/definitions/522.html