A security researcher reports that a company's cloud object storage bucket holding customer invoices can be listed and downloaded anonymously. The provider's service is working as designed, and the bucket policy grants public read access. Which vulnerability type is this?
Select an answer to reveal the explanation.
Short Explanation
The cloud did exactly what it was told -- the problem is what it was told. A bucket set to public read is a misconfiguration, plain and simple. Under the shared responsibility model, that setting is your side of the line, not the provider's.
Full Explanation
Misconfiguration is one of the most common vulnerabilities in cloud environments, and public object storage is listed as its own attack surface. Object storage services allow access policies that range from private to fully public. When a bucket that holds sensitive data grants anonymous list or read access, anyone who discovers its name can retrieve the contents, and automated tools continually search for such buckets. Because the provider's service behaves as designed and the policy itself grants the access, the weakness is the customer's configuration. A zero-day flaw would be an undisclosed defect in the provider's code, but the scenario states the service is working correctly. A race condition requires a timing window between a check and an action, whereas this access is granted consistently by policy. A malicious update to a client toolkit would involve compromised software delivered to users, which has no bearing on a bucket policy set by the customer. Exam caveat: under the shared responsibility model, the provider secures the service and the customer secures how it is configured and who can access its data. Operational check: remove public access, enable the account-level block on public access where available, review access logs to determine what was downloaded, and add a posture management rule that alerts on any public bucket.