Exposure of Core Dump File to an Unauthorized Control Sphere

Opis

The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Skutki

• Confidentiality

  Read Application Data; Read Files or Directories

Zapobieganie

• System Configuration

  Protect the core dump files from unauthorized access.

Przykłady podatności

• CVE-2024-10403 SAN firmware OS includes SFTP/FTP server password in a core dump

Słabość nadrzędna

• CWE-552 Files or Directories Accessible to External Parties

Kiedy powstaje

• Operation — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Dotyczy

Not Language-Specific