CWEweakness

CWE-220 Storage of File With Sensitive Data Under FTP Root

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

Common consequences

• Confidentiality: Read Application Data

Potential mitigations

• [Implementation, System Configuration] Avoid storing information under the FTP root directory. • [System Configuration] Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the FTP directory.

Related

Child of · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness