CWE-541: Inclusion of Sensitive Information in an Include File
Description
If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Confidentiality
Read Application Data
Potential mitigations
- Architecture and Design
Do not store sensitive information in include files.
- Architecture and DesignSystem Configuration
Protect include files from being exposed.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.