The application stores sensitive data under the FTP document root with insufficient access control, which might make it accessible to untrusted parties.
Time of Introduction
Operation
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Potential Mitigations
Avoid storing information under the FTP root directory.
Access control permissions should be set to prevent reading/writing of
sensitive files inside/outside of the FTP directory.
Background Details
Various Unix FTP servers require a password file that is under the FTP
root, due to use of chroot.
Description
