CWE-922: Insecure Storage of Sensitive Information
Description
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Confidentiality
Read Application Data; Read Files or Directories
Attackers can read sensitive information by accessing the unrestricted storage mechanism.
- Integrity
Modify Application Data; Modify Files or Directories
Attackers can overwrite sensitive information by accessing the unrestricted storage mechanism.
Related weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.