CAPEC Definitions

    CAPEC Definitions / CAPEC-639

    CAPEC-639: Probe System Files

    An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.

    Severity:Medium
    Possibility:

    Extended Description

    No Extended Description.

    Mitigations

    Verify that files have proper access controls set, and reduce the storage of sensitive information to only what is necessary.

    Relationships with other CAPECs

    CAPEC-545: Pull Data from System Resources

    Details

    Prerequisites

    An adversary has access to the file system of a system.

    Related Weaknesses

    CWE-552: Files or Directories Accessible to External Parties

    Details