名稱: Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

一般資訊

引入方式

Architecture and Design : OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation
System Configuration

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

常見後果

範圍	影響	可能性
Confidentiality	Read Application Data, Read Files or Directories 注意：Attackers can read sensitive information by accessing the unrestricted storage mechanism.
Integrity	Modify Application Data, Modify Files or Directories 注意：Attackers can overwrite and possibly delete sensitive information by accessing the unrestricted storage mechanism, causing incorrect results and possibly a denial of service.

觀察到的案例

參考資料	描述
CVE-2009-2272	password and username stored in cleartext in a cookie

偵測方法

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有效性 : High

漏洞對應備注

理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate
備註 : Examine children of this entry to see if there is a better fit

備注

There is an overlapping relationship between insecure storage of sensitive information (CWE-922) and missing encryption of sensitive information (CWE-311). Encryption is often used to prevent an attacker from reading the sensitive data. However, encryption does not prevent the attacker from erasing or overwriting the data. While data tampering would be visible upon inspection, the integrity and availability of the data is compromised prior to the audit.
This is a high-level entry that includes children from various parts of the CWE research view (CWE-1000). Currently, most of the information is in these child entries. This entry will be made more comprehensive in later CWE versions.

參考資料

REF-1283

OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management
Forescout Vedere Labs.
https://www.forescout.com/resources/ot-icefall-report/

提交

名稱	機構	日期	發布日期	Version
CWE Content Team	MITRE	2013-06-23 +00:00	2013-07-17 +00:00	2.5

修改記錄

名稱	機構	日期	備註
CWE Content Team	MITRE	2017-11-08 +00:00	updated Modes_of_Introduction, Relationships
CWE Content Team	MITRE	2019-06-20 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2021-03-15 +00:00	updated Maintenance_Notes
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated Common_Consequences, Relationship_Notes
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Detection_Factors, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Demonstrative_Examples, References, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Dimensions

CWE-922 詳細資料

CWE-922