The application stores sensitive data under the FTP document
root with insufficient access control, which might make it accessible to
untrusted parties.
Time of Introduction
Operation
Architecture and Design
Applicable Platforms
Languages
All
Potential Mitigations
Phase
Description
Avoid storing information under the FTP root directory.
Access control permissions should be set to prevent reading/writing of
sensitive files inside/outside of the FTP directory.
Background Details
Various Unix FTP servers require a password file that is under the FTP
root, due to use of chroot.
Description
