Cyber Resilience

CWE · MITRE source

CWE-922Insecure Storage of Sensitive Information

Abstraction: Class · CVEs in our corpus: 376

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 2 framework(s): STIG windows server 2016 2 (partial) · STIG windows server 2019 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • CP-6 Alternate Storage Site
  • CP-9 System Backup
  • CM-12 Information Location
  • PM-17 Protecting Controlled Unclassified Information on External Systems
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (8)AI-assisted

Control Title Family Why it addresses this CWE
CP-6Alternate Storage SiteCPEstablishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.
CP-9System BackupCPRequiring protection of backup information directly addresses insecure storage of sensitive data in backups.
CM-12Information LocationCMTracking information locations and access supports secure storage practices instead of insecure ones.
PM-17Protecting Controlled Unclassified Information on External SystemsPMPolicy explicitly addresses insecure storage of CUI on external systems, requiring compliant handling and protections.
RA-2Security CategorizationRAProper categorization drives selection of storage controls that keep sensitive information from being stored insecurely.
SC-28Protection of Information at RestSCThe control explicitly requires secure storage mechanisms for sensitive information, closing the insecure-storage weakness class.
SI-23Information FragmentationSIStoring information as fragments on distinct components is an architectural control that avoids insecure single-location storage of the complete sensitive data set.
SR-7Supply Chain Operations SecuritySROPSEC requirements improve handling and storage practices for sensitive supply-chain information.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-27170 8.49.80.15952021-02-10
CVE-2020-8481 7.69.80.01812020-04-29
CVE-2021-42371 7.69.80.01512021-11-08
CVE-2025-12539 7.610.00.01062025-11-11
CVE-2023-29727 7.59.80.01212023-05-30
CVE-2024-4995 7.59.80.00932024-12-18
CVE-2017-5249 7.49.80.00692018-02-22
CVE-2017-5250 7.49.80.00692018-02-22
CVE-2024-7569 7.19.60.01742024-08-13
CVE-2017-7253 7.08.80.02592017-03-30
CVE-2020-13937 7.05.30.78332020-10-19
CVE-2021-28813 7.09.60.01092021-09-10
CVE-2023-32191 7.09.90.00662024-10-16
CVE-2024-30896 7.09.10.05212024-11-21
CVE-2025-8699 7.09.10.00742025-09-12
CVE-2024-10943 6.99.10.00482024-11-12
CVE-2024-53931 6.89.10.00352025-01-06
CVE-2024-53932 6.89.10.00352025-01-06
CVE-2026-334076.89.10.00372026-03-24
CVE-2023-42913 6.68.80.00542024-03-28
CVE-2025-28244 6.68.80.00452025-07-10
CVE-2022-35513 6.57.50.04642022-09-07
CVE-2024-22773 6.38.10.00972024-02-06
CVE-2023-50298 6.27.50.01562024-02-09
CVE-2024-37728 6.27.50.01852024-09-10