Tag Archives: CWE- 922

CWE-922 – Insecure Storage of Sensitive Information

Read Time:34 Second

Description

The software stores sensitive information without properly limiting read or write access by unauthorized actors.

If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit:

 

Related Weaknesses

CWE-664

 

Consequences

Confidentiality: Read Application Data, Read Files or Directories

Attackers can read sensitive information by accessing the unrestricted storage mechanism.

Integrity: Modify Application Data, Modify Files or Directories

Attackers can read sensitive information by accessing the unrestricted storage mechanism.

 

Potential Mitigations

CVE References