The product stores sensitive information in a file system or device that does not have built-in access control.
View on MITREWhile many modern file systems or devices utilize some form of access control in order to restrict access to data, not all storage mechanisms have this capability. For example, memory cards, floppy disks, CDs, and USB devices are typically made accessible to any user within the system. This can become a problem when sensitive data is stored in these mechanisms in a multi-user environment, because anybody on the system can read or write this data. On Android devices, external storage is typically globally readable and writable by other applications on the device. External storage may also be easily accessible through the mobile device's USB connection or physically accessible through the device's memory card port.
Attackers can read sensitive information by accessing the unrestricted storage mechanism.
Attackers can modify or delete sensitive information by accessing the unrestricted storage mechanism.
No mitigation information available for this CWE.
No detection method information available for this CWE.
No examples or observed CVEs available for this CWE.
No relationship information available for this CWE.
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product stores sensitive information in a file system or device that does not have built-in access control. While many modern file systems or devices utilize some form of access control in order to restrict access to data, not all storage mechanisms have this capability. For example, memory cards, floppy disks, CDs, and USB devices are typically made accessible to any user within the system. This can become a problem when sensitive data is stored in these mechanisms in a multi-user environment, because anybody on the system can read or write this data. On Android devices, external storage is typically globally readable and writable by other applications on the device. External storage may also be easily accessible through the mobile device's USB connection or physically accessible through the device's memory card port.
If exploited, CWE-921 (Storage of Sensitive Data in a Mechanism without Access Control) it can compromise Confidentiality and Integrity, leading to outcomes such as Read Application Data, Read Files or Directories, Modify Application Data and Modify Files or Directories.
CWE-921 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-921 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.