CWE-220: Storage of File With Sensitive Data Under FTP Root
Description
The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Confidentiality
Read Application Data
Potential mitigations
- ImplementationSystem Configuration
Avoid storing information under the FTP root directory.
- System Configuration
Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the FTP directory.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.