CWE-220 - Storage of File With Sensitive Data Under FTP Root

Read Time:30 Second

Description

The application stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

Various Unix FTP servers require a password file that is under the FTP root, due to use of chroot.

Modes of Introduction:

– Operation

Related Weaknesses

CWE-552

Consequences

Confidentiality: Read Application Data

Potential Mitigations

Phase: Implementation, System Configuration

Description:

Avoid storing information under the FTP root directory.

Phase: System Configuration

Description:

Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the FTP directory.

CVE References

InCWE- 220, Storage of File With Sensitive Data Under FTP Root

The Most Dangerous Vulnerabilities in Apache Tomcat and How to Protect Against Them

Apache Tomcat is an open-source web server and servlet container that is widely used in enterprise environments to run Java...

rocco

February 19, 2023February 19, 2023

ZDI-CAN-18333: A Critical Zero-Day Vulnerability in Microsoft Windows

Zero-day vulnerabilities are a serious threat to cybersecurity, as they can be exploited by malicious actors to gain unauthorized access...

rocco

February 19, 2023February 19, 2023

CWE-669 – Incorrect Resource Transfer Between Spheres

Description The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere,...

rocco

May 26, 2022