CVE-2024-22387

Requires cryptographic or other protection of information at rest, directly blocking unauthorized external access to critical state.

A.5.15 only requires determining requirements, defining a topic-specific policy on access control, and considering factors like need-to-know and segregation; it does not itself enforce, implement, or configure any access restrictions that would stop exploitation of externally controllable critical state data.

A.5.18's provisioning, revocation, review and adjustment of authorized access rights (including before role changes/termination) directly stops unauthorized actors from reaching externally-controlled critical state data in most cases; the bounded remainder is state stored outside any access-controlled container or channel.

A.8.2 controls the allocation, review, expiry and use of privileged rights via authorization and least-privilege rules; it has no bearing on whether critical state data is stored in an attacker-accessible location, so the weakness can still be introduced and exploited independently of this control.

Secure development practices can avoid placing critical state in externally writable locations.

A.8.26 only requires that security requirements (including access controls, encryption, input validation, etc.) be identified and specified during development or acquisition; it does not itself enforce, implement or configure those measures to stop exploitation of externally controllable critical state data.

A.8.27 mandates security-by-design principles (least privilege, default deny, assume breach, distrust external input, defence-in-depth, hardening, zero-trust verification) that reach some but not most instances of externally controllable critical state data; many storage-location and exposure-design flaws remain outside its named coverage.