Exposed Sensitive PDF: Misconfigured Access Controls Leading to Information Disclosure

How it was found

Description: An internal PDF document, marked “UNCLASSIFIED // NOT APPROVED FOR PUBLIC RELEASE // FOR OFFICIAL USE ONLY,” is publicly accessible on the ACC website. This misconfiguration allows unauthorized users to download and view sensitive internal content, resulting in an unintended disclosure of information. ** References:** CWE-200: Information Disclosure

Impact

An attacker can view, download, and potentially disseminate sensitive internal information. This exposure can compromise operational security, lead to reputational damage, and enable targeted cyber attacks by revealing confidential internal communications.

System Host(s)

██████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

1.Open a web browser. 2.Navigate to: ██████████ 3.Observe that the PDF loads without any authentication or access controls. 4.Verify that the document contains internal markings indicating it is not approved for public release.

Suggested Mitigation/Remediation Actions

Restrict public access to the folder or server hosting the document by updating access controls and permissions. Implement authentication or other measures to ensure only authorized users can view sensitive documents. Audit related directories on the ACC website for other inadvertent exposures and remediate accordingly.