CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.6)  

CWE-219: Sensitive Data Under Web Root

 
Sensitive Data Under Web Root
Weakness ID: 219 (Weakness Variant)Status: Draft
+ Description

Description Summary

The application stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
+ Time of Introduction
  • Operation
  • Implementation
+ Applicable Platforms

Languages

All

+ Observed Examples
ReferenceDescription
CVE-2005-1835Data file under web root.
CVE-2005-2217Data file under web root.
CVE-2002-1449Username/password in data file under web root.
CVE-2002-0943Database file under web root.
CVE-2005-1645database file under web root.
+ Potential Mitigations
PhaseDescription

Avoid storing information under the web root directory.

Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class216Containment Errors (Container Errors)
Development Concepts (primary)699
Research Concepts1000
ChildOfWeakness ClassWeakness Class668Exposure of Resource to Wrong Sphere
Research Concepts (primary)1000
ChildOfCategoryCategory731OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOfWeakness VariantWeakness Variant433Unparsed Raw Web Content Delivery
Research Concepts (primary)1000
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERSensitive Data Under Web Root
OWASP Top Ten 2004A10CWE More SpecificInsecure Configuration Management
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-08-15VeracodeExternal
Suggested OWASP Top Ten 2004 mapping
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Taxonomy Mappings
Back to top
Page Last Updated: October 29, 2009
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us