CWE-219 Storage of File with Sensitive Data Under Web Root

variant

The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

übergeordnete Schwächen

Übergeordnete Klassen, zu denen dies gehört.

CWE-552Files or Directories Accessible to External Parties

untergeordnete Schwächen

Spezifischere Einträge unterhalb dieses.

CWE-433Unparsed Raw Web Content Delivery

Schwachstellen (7)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-21236US	high7.5	1.81% (79th)	—	2022-01-28
An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disc…
CVE-2024-39776US	high7.5	0.39% (32nd)	—	2024-08-22
Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.
CVE-2022-36306US	medium6.5	1.00% (62nd)	—	2022-08-16
An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configur…
CVE-2024-56159US	medium5.3	1.54% (75th)	—	2024-12-19
Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with c…
CVE-2002-2024US	medium5.0	1.92% (80th)	—	2002-12-31
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ld…
CVE-2026-45140US	—	1.33% (71st)	Exploit	2026-09-17
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authori…
CVE-2023-39467US	—	0.58% (47th)	—	2024-05-03
Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in…

Quelle

Wo diese Definition veröffentlicht ist.

MITREUS

scry

Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan