Cyber Resilience

CWE · MITRE source

CWE-552Files or Directories Accessible to External Parties

Abstraction: Base · CVEs in our corpus: 492

The product makes files or directories accessible to unauthorized actors, even though they should not be.

Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories. In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.

Last updated: 22 August 2026 00:25 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 12 mapping(s) from 3 framework(s): ATT&CK 8 (partial) · CAPEC 2 (partial) · STIG oracle linux 8 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PM-1 Information Security Program Plan
  • PM-17 Protecting Controlled Unclassified Information on External Systems
  • PM-5 System Inventory
  • CM-10 Software Usage Restrictions
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V8.4.2

NIST 800-53 r5 controls that address this weakness (18)AI-assisted

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
PM-1Information Security Program PlanPMExplicit protection requirements make it harder for the plan document to remain accessible to external parties or unauthorized spheres.
PM-17Protecting Controlled Unclassified Information on External SystemsPMProcedures ensure CUI files and resources are not made accessible to external parties without required protections.
PM-5System InventoryPMEnumerating systems surfaces externally reachable resources that would otherwise remain unmonitored and accessible.
CM-10Software Usage RestrictionsCMControlling and documenting P2P file sharing prevents files and directories from being made accessible to external parties for unauthorized distribution.
CM-12Information LocationCMIdentifying and documenting file and directory locations allows restriction of access to external parties.
MP-1Policy and ProceduresMPPolicy restricts media access to authorized parties only, preventing exposure of resources to external or unauthorized actors.
MP-2Media AccessMPMedia access restrictions prevent files or directories from being accessible to external parties.
PE-17Alternate Work SitePEEmploying and evaluating controls at documented alternate sites makes files and directories less likely to be accessible to external parties through physical or environmental weaknesses.
PE-3Physical Access ControlPEControls access to facility areas (including publicly accessible zones) to prevent external parties from reaching internal resources or sensitive locations.
SC-14Public Access ProtectionsSCPrevents public exposure of files or directories that should not be reachable by unauthenticated parties.
SC-26DecoysSCDecoy files and directories detect external access attempts and deflect attackers away from actual accessible resources.
AC-22Publicly Accessible ContentACControls on authorized publication limit files and directories with nonpublic data from becoming accessible to external parties.
CP-9System BackupCPProtecting backup files ensures they are not accessible to external parties or unauthorized spheres.
MA-2Controlled MaintenanceMASanitizing equipment before off-site maintenance reduces the risk of files or directories containing sensitive data becoming accessible to external parties.
RA-2Security CategorizationRACategorization results dictate which files and directories must be restricted, making unauthorized external access less likely.
Show 3 more broadly-applicable controls
SA-6Software Usage RestrictionsSAExplicit controls on peer-to-peer file sharing prevent files and directories from being made accessible to external parties without authorization.
SI-20TaintingSIDetects improper removal of data from files or directories that are accessible to external parties.
SR-7Supply Chain Operations SecuritySRControls ensure files and directories holding supply-chain data are not left accessible to unauthorized actors.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1003 OS Credential Dumping→PT1119 Automated Collection←P →MT1213 Data from Information Repositories←P →PT1552.001 Credentials In Files←P →MT1552.003 Shell History←P →PT1552.004 Private Keys←P →MT1552.006 Group Policy Preferences←P →MT1555 Credentials from Password Stores←P →PT1602 Data from Configuration Repository←P →M

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-50164 9.99.80.80822023-12-07
CVE-2017-14942 9.69.80.60862017-09-30
CVE-2024-53676 9.49.80.51622024-11-27
CVE-2024-39931 9.19.90.52662024-07-04
CVE-2017-16651 KEV 8.57.80.36922017-11-09
CVE-2020-17519 KEV 8.57.50.97862021-01-05
CVE-2024-6209 8.510.00.17162024-07-05
CVE-2025-11371 KEV 8.57.50.92092025-10-09
CVE-2024-2056 8.49.80.16712024-03-05
CVE-2021-39316 8.37.50.65762021-08-31
CVE-2020-15175 8.27.40.71352020-10-07
CVE-2026-25137 7.79.10.09532026-02-02
CVE-2019-19843 7.69.80.01822020-01-22
CVE-2020-12743 7.69.80.01512020-05-11
CVE-2020-10516 7.69.80.01592020-06-03
CVE-2021-1361 7.69.80.01572021-02-24
CVE-2022-25299 7.69.80.01432022-02-18
CVE-2024-56731 7.610.00.00942025-06-24
CVE-2016-3715 KEV 7.55.50.75382016-05-05
CVE-2017-10930 7.59.80.01082017-09-19
CVE-2023-29931 7.59.80.00892023-06-22
CVE-2024-2055 7.59.80.00932024-03-05
CVE-2024-4098 7.59.80.01012024-06-20
CVE-2025-48928 KEV 7.54.00.00532025-05-28
CVE-2025-41240 7.510.00.00702025-07-24