CWE-1266 Improper Scrubbing of Sensitive Data from Decommissioned Device

base

The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.

parent weaknesses

Broader classes this is a kind of.

CWE-404Improper Resource Shutdown or Release

attack patterns (5)

CAPEC attack patterns that exploit this.

CAPEC-150Collect Data from Common Resource Locations
CAPEC-37Retrieve Embedded Sensitive Data
CAPEC-545Pull Data from System Resources
CAPEC-546Incomplete Data Deletion in a Multi-Tenant Environment
CAPEC-675Retrieve Data from Decommissioned Devices

source

Where this definition is published.

MITREUS

scry

Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.

Free scan