Insecure Data Storage

Sensitive data persisted without protection: plaintext key-value stores, misused Keychain/Keystore, backup leakage, clipboard, screenshots, logs, keyboard cache, temp files, and over-sharing third-party SDKs.

17 vulnerabilities. OWASP Mobile: M9

Vulnerability	ID	Platform	Difficulty	OWASP	MASVS	MASWE	MASTG (v2)	CWE
Clipboard Leakage of Sensitive Fields	`clipboard_leakage`	AndroidiOS	EASY	M9	MASVS-STORAGE-2	MASWE-0030	MASTG-TEST-0276 MASTG-TEST-0277 MASTG-TEST-0278 MASTG-TEST-0279 MASTG-TEST-0280	CWE-200
Insecure Backups (allowBackup / unencrypted iOS backups)	`insecure_backups`	AndroidiOS	EASY	M9	MASVS-STORAGE-2	MASWE-0006	MASTG-TEST-0216 MASTG-TEST-0215 MASTG-TEST-0262 MASTG-TEST-0298	CWE-530
Insecure Local Storage (Plaintext SharedPreferences/UserDefaults)	`insecure_local_storage`	AndroidiOS	EASY	M9	MASVS-STORAGE-1	MASWE-0001	MASTG-TEST-0287 MASTG-TEST-0300 MASTG-TEST-0301 MASTG-TEST-0302	CWE-312 CWE-922
Insecure SD-Card / External Storage	`insecure_sdcard_external_storage`	Android	EASY	M9	MASVS-STORAGE-1 MASVS-STORAGE-2	MASWE-0002	MASTG-TEST-0200 MASTG-TEST-0201 MASTG-TEST-0202	CWE-312 CWE-921
Screenshot / Task-Switcher Leakage	`screenshot_taskswitcher_leakage`	AndroidiOS	EASY	M9	MASVS-STORAGE-2 MASVS-PLATFORM-3	MASWE-0038	MASTG-TEST-0289 MASTG-TEST-0291 MASTG-TEST-0292 MASTG-TEST-0290	CWE-200
Sensitive Data in Crash Reports	`sensitive_data_in_crash_reports`	AndroidiOS	EASY	M9	MASVS-STORAGE-1 MASVS-PRIVACY-1	MASWE-0005	-	CWE-200 CWE-532 CWE-201
Sensitive Data in Logs	`sensitive_data_in_logs`	AndroidiOS	EASY	M9	MASVS-STORAGE-2	MASWE-0005	MASTG-TEST-0203 MASTG-TEST-0231 MASTG-TEST-0296 MASTG-TEST-0297	CWE-532
Authentication-State Rollback / Restore	`auth_state_rollback_restore`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-1 MASVS-STORAGE-2	MASWE-0006	MASTG-TEST-0338 MASTG-TEST-0387	CWE-384 CWE-613 CWE-565
Keyboard Cache & Autofill Leakage	`keyboard_cache_autofill_leakage`	AndroidiOS	MEDIUM	M9	MASVS-STORAGE-2	MASWE-0036	MASTG-TEST-0258 MASTG-TEST-0313 MASTG-TEST-0314	CWE-524
Keychain/Keystore Misuse	`keychain_keystore_misuse`	AndroidiOS	MEDIUM	M9	MASVS-STORAGE-1 MASVS-CRYPTO-2	MASWE-0003	MASTG-TEST-0287 MASTG-TEST-0300 MASTG-TEST-0301	CWE-312 CWE-522
Local Security-State Integrity Tampering	`local_security_state_integrity_tampering`	AndroidiOS	MEDIUM	M9	MASVS-STORAGE-2 MASVS-AUTH-1	MASWE-0006	MASTG-TEST-0338 MASTG-TEST-0387	CWE-565 CWE-345 CWE-602
Temp / Cache File Leftovers	`temp_file_leftovers`	AndroidiOS	MEDIUM	M9	MASVS-STORAGE-1	MASWE-0001	MASTG-TEST-0207 MASTG-TEST-0299 MASTG-TEST-0302	CWE-459 CWE-312
Third-Party SDK Data Leakage	`third_party_sdk_data_leakage`	AndroidiOS	MEDIUM	M9	MASVS-STORAGE-2 MASVS-PRIVACY-1	MASWE-0069	MASTG-TEST-0318 MASTG-TEST-0319	CWE-200 CWE-359
Backup Archive Integrity Tampering	`backup_archive_integrity_tampering`	AndroidiOS	HARD	M9	MASVS-STORAGE-2 MASVS-RESILIENCE-3	MASWE-0006	MASTG-TEST-0338 MASTG-TEST-0387	CWE-345 CWE-565 CWE-494
Keychain Access-Group Authorization Confusion	`keychain_access_group_authorization_confusion`	iOS	HARD	M9	MASVS-STORAGE-1 MASVS-AUTH-1	MASWE-0001	MASTG-TEST-0388	CWE-522 CWE-284 CWE-668
Keychain State Integrity Manipulation	`keychain_state_integrity_manipulation`	iOS	HARD	M9	MASVS-STORAGE-1 MASVS-CRYPTO-2	MASWE-0001	MASTG-TEST-0387 MASTG-TEST-0338	CWE-345 CWE-565 CWE-472
Sensitive Data in Memory	`sensitive_data_in_memory`	AndroidiOS	HARD	M9	MASVS-STORAGE-1	MASWE-0001	MASTG-TEST-0011 MASTG-TEST-0060	CWE-316 CWE-226