CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Common consequences
- Confidentiality: Read Files or Directories
Mitigations
Architecture and Design — Do not expose file and directory information to the user.
References
- CWE page: https://cwe.mitre.org/data/definitions/538.html
- CWE list: https://cwe.mitre.org/data/index.html