CWE-219
Storage of File with Sensitive Data Under Web Root
The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
Mitigation
Phases: Implementation, System Configuration
Description:
- Avoid storing information under the web root directory.
Mitigation
Phase: System Configuration
Description:
- Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.
No CAPEC attack patterns related to this CWE.