A county open-data project discovers a cloud storage bucket holding draft resident datasets is configured for public read without authentication. Which vulnerability type best describes this finding?
Select an answer to reveal the explanation.
Short Explanation
A cloud bucket left on "anyone can read" is cloud misconfiguration — the data walked out the front door without a break-in exploit. Fix the ACL; this is not a buffer overflow or a TOC/TOU race. Municipal cloud storage needs least-privilege and continuous config review.
Full Explanation
Cloud-specific misconfiguration occurs when cloud resource settings—not a memory bug or social engineer—expose data, commonly via publicly readable storage without authentication. A county open-data bucket holding draft resident datasets with public read means sensitive drafts are reachable by anyone who discovers the URL or enumerates the bucket. The vulnerability is incorrect access configuration in the cloud control plane.
Buffer overflow in a legacy on-premises scanning service is memory corruption on a local daemon. Public bucket ACLs are a cloud configuration issue.
Vishing that coerces a help-desk password reset is voice social engineering. No phone reset is required for world-readable object storage.
Race condition TOC/TOU on a local file-permission check is a concurrency flaw. It does not describe cloud storage left publicly accessible.
Exam caveat: Cloud misconfiguration is frequently tested as open buckets, overly permissive security groups, or public snapshots. Distinguish from vulnerabilities in cloud provider code (shared responsibility: customer config vs provider flaws). Draft resident data still demands least privilege even in "open data" programs until publication is intentional and scrubbed.
Operational check: enable block-public-access defaults, continuous CSPM or native config auditing, least-privilege bucket policies, separate accounts for draft versus published open data, and encryption with tightly controlled keys. Remediating the ACL is immediate; preventing recurrence requires guardrails and reviews for every municipal cloud storage account.