CVE-2023-28344

Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.

The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.

The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.

Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.

Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.

Controlling internal connections prevents exposure of resources to unintended internal spheres.

Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.

The control prevents exposure of the media resource to the wrong security sphere.

Network segmentation and unauthorized-access protections reduce the chance of resources being reachable by the wrong sphere.

Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.

Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.

Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.

Application security requirements include rules for safe file handling and canonicalization.

Secure architecture principles require least-privilege file access and directory isolation.

Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.