CWE-922: Insecure Storage of Sensitive Information
Class
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.
Consequences
- Confidentiality: Read Application Data, Read Files or Directories
- Integrity: Modify Application Data, Modify Files or Directories
Recent advisories
- GHSA-x3x5-7h4h-gwxg — HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
- GHSA-q93q-v844-jrqp — kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
- GHSA-vpq5-56jj-vf2m — Moodle admin presets export tool includes some secrets that should not be exported
- GHSA-69fp-7c8p-crjr — Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
- GHSA-79wq-g4v9-gfj4 — Publify Core does not strip metadata from images
- GHSA-qpj5-f88q-x7px — MantisBT Insecure Storage in manage_proj_edit_page.php
- GHSA-j8cx-j9j2-f29w — Insecure Storage of Sensitive Information in Microweber
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor