6. of Tampering
An attacker can write to a data store your code relies on:
|
Threat |
|
|
|
Your data store, be it a database, filesystem, or object storage, doesn’t require authentication. |
|
CAPEC |
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-470: Expanding Control over the Operating System from the Database CAPEC-592: Stored XSS |
|
ASVS |
1.2.2: Verify access to the data layer is authenticated and the principle of least privilege is being used |
|
CWE |
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control |
|
Mitigations |
|
|
|
|
