Would something like this satisfy you: The system provides functionality for (password reset via email|sending plaintext password reminder emails|other passwor

Would something like this satisfy you: The system provides functionality for (password reset via email|sending plaintext password reminder emails|other password-based credential recovery|other delegation or retention of password-based credentials) which strongly suggests that an attacker who succeeded in (cross site scripting (XSS)|cross site request forgery (XSRF)|obtaining production server access|obtaining production database access|obtaining back-up meda|observeing network traffic|actively injecting network traffic) would then be subsequently capable of (logging into this site with a targeted user's password-based credentials|mounting on-line attacks against (a specific user's|all users') password-based credentials|mounting (dictionary|non-dictionary) off-line brute-force attacks against (a specific user's|all users') password-based credentials)|passive decryption attacks|active man-in-the-middile attacks) (with little or no work factor). This (is|is not) recommended for (urgent) remediation. It (is likely|is not) sufficient to meet Payment Card Industry (PCI) standards or other adequate standards of care in the industry. Check all that apply. Also see http://cwe.mitre.org/data/definitions/719.html http://cwe.mitre.org/data/definitions/719.html , for example http://capec.mitre.org/data/definitions/55.html http://capec.mitre.org/data/definitions/55.html .