1824
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 399 Resource Management Errors 2324
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Mobile (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Other)
DoS: Crash, Exit, or Restart
The power source could be drained, causing the
application - and the entire device - to cease functioning.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 3-3 Req SR 6.2
ISA/IEC 62443 Part 4-2 Req CR 6.2
ISA/IEC 62443 Part 4-1 Req SD-4
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
Weakness ID : 921
Structure : Simple
Abstraction : Base
Description
The product stores sensitive information in a file system or device that does not have built-in
access control.
Extended Description
While many modern file systems or devices utilize some form of access control in order to restrict
access to data, not all storage mechanisms have this capability. For example, memory cards,
floppy disks, CDs, and USB devices are typically made accessible to any user within the system.
This can become a problem when sensitive data is stored in these mechanisms in a multi-user
environment, because anybody on the system can read or write this data.
On Android devices, external storage is typically globally readable and writable by other
applications on the device. External storage may also be easily accessible through the mobile
device's USB connection or physically accessible through the device's memory card port.
Relationships
CWE Version 4.14
CWE-922: Insecure Storage of Sensitive Information
CWE-922: Insecure Storage of Sensitive Information