CWEweakness
CWE-219 Storage of File with Sensitive Data Under Web Root
- Abstraction
- Variant
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
Common consequences
• Confidentiality: Read Application Data — If the server is not configured or otherwise used to prevent direct access to those files, then attackers may obtain this sensitive data.
Potential mitigations
• [Implementation, System Configuration] Avoid storing information under the web root directory.
• [System Configuration] Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.
Observed examples
• CVE-2005-1835: Data file under web root.
• CVE-2005-2217: Data file under web root.
• CVE-2002-1449: Username/password in data file under web root.
• CVE-2002-0943: Database file under web root.
• CVE-2005-1645: database file under web root.
Related
Observed example · CVE (5)
- CVE-2005-2217 Dansie Shopping Cart stores the vars.dat file under the web root with insufficient access control, which might allow remote attackers to… vulnerability
- CVE-2005-1835 NEXTWEB (i)Site stores databases under the web document root with insufficient access control, which allows remote attackers to obtain… vulnerability
- CVE-2005-1645 Keyvan1 ImageGallery stores the image.mdb database under the web document root with insufficient access control, which allows remote… vulnerability
- CVE-2002-0943 MetaCart2.sql stores the user database under the web document root without access controls, which allows remote attackers to obtain… vulnerability
- CVE-2002-1449 eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite… vulnerability
Child of · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
Referenced by CVE · weakness (7)
- CVE-2026-45140 Chamilo LMS is an open-source learning management system. vulnerability
- CVE-2024-56159 Astro is a web framework for content-driven websites. vulnerability
- CVE-2024-39776 Avtec Outpost stores sensitive information in an insecure location without proper access controls in place. vulnerability
- CVE-2023-39467 Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. vulnerability
- CVE-2022-36306 An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web… vulnerability
- CVE-2022-21236 An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. vulnerability
- CVE-2002-2024 Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2)… vulnerability
Referenced by CWE · child of (1)
- CWE-433 Unparsed Raw Web Content Delivery weakness