BaseIncomplete

CWE-921Storage of Sensitive Data in a Mechanism without Access Control

Category: data-exposure

Description

The product stores sensitive information in a file system or device that does not have built-in access control.

Common consequences· 2

  • Confidentiality — Read Application Data, Read Files or Directories
    Attackers can read sensitive information by accessing the unrestricted storage mechanism.
  • Integrity — Modify Application Data, Modify Files or Directories
    Attackers can modify or delete sensitive information by accessing the unrestricted storage mechanism.

References

  1. https://cwe.mitre.org/data/definitions/921.html

(incoming)1

TypeTargetConfidenceTier
VulnerabilityCVE-2025-30016cve-2025-300160%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CWE
Missing Encryption of Sensitive Data
CWE
Exposure of Sensitive System Information to an Unauthorized Control Sphere
CWE
Insecure Storage of Sensitive Information
CWE
External Control of Critical State Data
CWE
Cleartext Storage of Sensitive Information
CWE
Exposure of Sensitive Information to an Unauthorized Actor
Sourced from MITRE CWE 4.20. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.