Skip to content
OpenAdvisories

Weakness (CWE)

CWE-219: Storage of File with Sensitive Data Under Web Root

Variant Draft

The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

How to prevent it (2 mitigations)

  1. Implementation, System Configuration

    Avoid storing information under the web root directory.

  2. System Configuration

    Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.

Source: MITRE CWE-219

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.2
    GHSA-xvp7-8vm8-xfxx

    Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

    ### Summary The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using `console.log`and `console.debug` (Which in this version of node is an alias for `console.log`). This is exposing sensitive information in log fil…

    @actual-app/sync-server npm
  • Medium 5.3
    CVE-2023-39467

    Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability

    Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not re…

    Triangle MicroWorks SCADA Data Gateway
  • Medium 5.3
    CVE-2002-2024

    Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3,…