CWE-220

Variant Abstraction Level
Pillar — Highest-level weakness category
Class — Abstract, language-independent
Base — Specific enough to detect
Variant — Tied to specific technology
Compound — Requires multiple weaknesses Draft MITRE CWE Status
Stable — Fully reviewed and complete
Draft — Under development, may change
Incomplete — Partially defined by MITRE
Deprecated — No longer recommended
Obsolete — Replaced by another CWE
Storage of File With Sensitive Data Under FTP Root

Description

The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

Consequences

Confidentiality — Read Application Data

Mitigations

Phase: Implementation, System Configuration

Avoid storing information under the FTP root directory.

Phase: System Configuration

Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the FTP directory.