Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-219:Storage of File with Sensitive Data Under Web Root
Weakness ID:219
Version:v4.17
Weakness Name:Storage of File with Sensitive Data Under Web Root
Vulnerability Mapping:Allowed
Abstraction:Variant
Structure:Simple
Status:Draft
Likelihood of Exploit:
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

▼Extended Description

Besides public-facing web pages and code, products may store sensitive data, code that is not directly invoked, or other files under the web document root of the web server. If the server is not configured or otherwise used to prevent direct access to those files, then attackers may obtain this sensitive data.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfAllowedB552Files or Directories Accessible to External Parties
ParentOfAllowedV433Unparsed Raw Web Content Delivery
Nature: ChildOf
Mapping: Allowed
Type: Base
ID: 552
Name: Files or Directories Accessible to External Parties
Nature: ParentOf
Mapping: Allowed
Type: Variant
ID: 433
Name: Unparsed Raw Web Content Delivery
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC731OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
MemberOfProhibitedC815OWASP Top Ten 2010 Category A6 - Security Misconfiguration
MemberOfProhibitedC963SFP Secondary Cluster: Exposed Data
MemberOfProhibitedC1011Authorize Actors
MemberOfProhibitedC1345OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
MemberOfProhibitedC1403Comprehensive Categorization: Exposed Resource
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 731
Name: OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 815
Name: OWASP Top Ten 2010 Category A6 - Security Misconfiguration
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 963
Name: SFP Secondary Cluster: Exposed Data
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1011
Name: Authorize Actors
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1345
Name: OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1403
Name: Comprehensive Categorization: Exposed Resource
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-294Not Language-Specific Weaknesses
MemberOfProhibitedBSBOSS-328Read Application Data (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-294
Name: Not Language-Specific Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-328
Name: Read Application Data (impact)
▼Relevant To View
Relevant to the view"Architectural Concepts - (1008)"
NatureMappingTypeIDName
MemberOfProhibitedC1011Authorize Actors
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1011
Name: Authorize Actors
Relevant to the view"OWASP Top Ten (2021) - (1344)"
NatureMappingTypeIDName
MemberOfProhibitedC1345OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1345
Name: OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC963SFP Secondary Cluster: Exposed Data
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 963
Name: SFP Secondary Cluster: Exposed Data
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
ConfidentialityN/ARead Application Data
N/A
Scope: Confidentiality
Likelihood: N/A
Impact: Read Application Data
Note:
N/A
▼Potential Mitigations
Phase:Implementation, System Configuration
Mitigation ID:
Strategy:
Effectiveness:
Description:

Avoid storing information under the web root directory.

Note:

Phase:System Configuration
Mitigation ID:
Strategy:
Effectiveness:
Description:

Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.

Note:

▼Modes Of Introduction
Phase: Operation
Note:

COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Phase: Implementation
Note:

COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

▼Applicable Platforms
Languages
Class: Not Language-Specific(Undetermined Prevalence)
▼Demonstrative Examples
▼Observed Examples
ReferenceDescription
CVE-2005-1835
Data file under web root.
CVE-2005-2217
Data file under web root.
CVE-2002-1449
Username/password in data file under web root.
CVE-2002-0943
Database file under web root.
CVE-2005-1645
database file under web root.
Reference: CVE-2005-1835
Description:
Data file under web root.
Reference: CVE-2005-2217
Description:
Data file under web root.
Reference: CVE-2002-1449
Description:
Username/password in data file under web root.
Reference: CVE-2002-0943
Description:
Database file under web root.
Reference: CVE-2005-1645
Description:
database file under web root.
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      ▼Detection Methods
      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      PLOVERN/AN/ASensitive Data Under Web Root
      OWASP Top Ten 2004A10CWE More SpecificInsecure Configuration Management
      Taxonomy Name: PLOVER
      Entry ID: N/A
      Fit: N/A
      Entry Name: Sensitive Data Under Web Root
      Taxonomy Name: OWASP Top Ten 2004
      Entry ID: A10
      Fit: CWE More Specific
      Entry Name: Insecure Configuration Management
      ▼Related Attack Patterns
      IDName
      ▼References
      Details not found