Insertion of Sensitive Information into Externally-Accessible File or Directory

Opis

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Skutki

• Confidentiality

  Read Files or Directories

Zapobieganie

• Architecture and Design, Operation, System Configuration

  Do not expose file and directory information to the user.

Przykłady podatności

• CVE-2018-1999036 SSH password for private key stored in build log

Słabość nadrzędna

• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Słabości podrzędne

• CWE-532 Insertion of Sensitive Information into Log File
• CWE-540 Inclusion of Sensitive Information in Source Code
• CWE-651 Exposure of WSDL File Containing Sensitive Information

Kiedy powstaje

• Implementation — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
• Operation — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Dotyczy

Not Language-Specific

Uwagi

Depending on usage, this could be a weakness or a category. Further study of all its children is needed, and the entire sub-tree may need to be clarified. The current organization is based primarily on the exposure of sensitive information as a consequence, instead of as a primary weakness.

There is a close relationship with CWE-552, which is more focused on weaknesses. As a result, it may be more appropriate to convert CWE-538 to a category.

Źródła

1. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 12: Information Leakage." Page 191, McGraw-Hill, 2010