The product stores sensitive information without properly limiting read or write access by unauthorized actors.
View on MITREIf read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.
Attackers can read sensitive information by accessing the unrestricted storage mechanism.
Attackers can overwrite sensitive information by accessing the unrestricted storage mechanism.
No mitigation information available for this CWE.
No detection method information available for this CWE.
CWE-922: Insecure Storage of Sensitive Information is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product stores sensitive information without properly limiting read or write access by unauthorized actors. If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.
If exploited, CWE-922 (Insecure Storage of Sensitive Information) it can compromise Confidentiality and Integrity, leading to outcomes such as Read Application Data, Read Files or Directories, Modify Application Data and Modify Files or Directories.
CWE-922 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-922, including CVE-2009-2272. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-922 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.