CWE-921 (在没有访问控制机制中存储敏感数据) — Vulnerability Class 8

CWE-921 represents a critical storage weakness where sensitive data is persisted in mechanisms lacking inherent access control, such as removable media like USB drives or memory cards. Attackers typically exploit this vulnerability by physically accessing these devices or leveraging local system privileges to read unencrypted files, thereby exposing confidential information like credentials or personal data without needing to bypass complex network defenses. To mitigate this risk, developers must enforce strict access controls on all storage mechanisms, ensuring that only authorized processes or users can read or write sensitive content. Additionally, implementing robust encryption for data at rest and utilizing secure, access-controlled storage solutions rather than removable media can significantly reduce the attack surface. Regular security audits and adherence to least-privilege principles further ensure that sensitive information remains protected against unauthorized access.