Rule Definition
This makes it easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide. It should be noted that, despite common perceptions, the use of a good salt with a hash does not sufficiently increase the effort for an attacker who is targeting an individual password, or who has a large amount of computing resources available, such as with cloud-based services or specialized, inexpensive hardware. Offline password cracking can still be effective if the hash function is not expensive to compute; many cryptographic functions are designed to be efficient and can be vulnerable to attacks using massive computing resources, even if the hash is cryptographically strong.

Remediation
Do not use Hardcoded Salt.

Violation Code Sample

Sample 1 
  ... 
    Encryptor instance = ESAPI.encryptor(); 
    String hash1 = instance.hash(input, "2!@$(5#@532@%#$253l5#@$"); 
    ... 
------------------------------------ 
Sample 2 
... 
private static final String salt = "2!@$(5#@532@%#$253l5#@$"; 
... 
PBEKeySpec pbeSpec=new PBEKeySpec(password); 
SecretKeyFactory keyFact=SecretKeyFactory.getInstance(CIPHER_ALG); 
PBEParameterSpec defParams=new PBEParameterSpec(salt,0); 
Cipher cipher=Cipher.getInstance(CIPHER_ALG); 
cipher.init(cipherMode,keyFact.generateSecret(pbeSpec),defParams); 
... 

This is a sample for Hardcoded PBE Salt.

Fixed Code Sample

PBEParameterSpec paramSpec =  new PBEParameterSpec(getSalt(), 2); // Violation FIXED

http://cwe.mitre.org/data/definitions/760.html