10. of Information Disclosure
An attacker can read sensitive information in a file with no ACLs.
Or the alternative text:
An attacker can read information in files or databases with no access controls.
|
Threat |
|
|
|
You have left an object store/bucket with public read and write access. An attacker has taken advantage of this to change the content used for your corporate identity and damage the image of your organization. |
|
CAPEC |
CAPEC-180 - Exploiting Incorrectly Configured Access Control Security Levels |
|
ASVS |
1.4.5 - Ensure usage of fine-grained access control such as ABAC. 4.1.3 - Ensure users or services only have the necessary privileges to perform the actions they need to do. |
|
CWE |
CWE-922 - Insecure Storage of... |
