Jack of Information Disclosure
An attacker can discover the fixed key being used to encrypt.
|
Threat |
|
|
|
You’ve used the same key everywhere and the key has global read permissions, enabling an attacker to steal the key in one place and gain access everywhere. |
|
CAPEC |
CAPEC-180 - Exploiting Incorrectly Configured Access Control Security Levels |
|
ASVS |
4.1.3 - Ensure users or services only have the necessary privileges to perform the actions they need to do. |
|
CWE |
CWE-921 - Storage of Sensitive Data in a Mechanism without Access Control CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere |
|
Mitigations |
