CWE-306: Missing Authentication for Critical Function

public BankAccount createBankAccount(String accountNumber, String accountType,String accountName, String accountSSN, double balance) {
                     
                        BankAccount account = new BankAccount();account.setAccountNumber(accountNumber);account.setAccountType(accountType);account.setAccountOwnerName(accountName);account.setAccountOwnerSSN(accountSSN);account.setBalance(balance);
                           return account;
                     }

private boolean isUserAuthentic = false;
                     
                     // authenticate user,
                     
                     
                     // if user is authenticated then set variable to true
                     
                     
                     // otherwise set variable to false
                     public boolean authenticateUser(String username, String password) {...}
                     public BankAccount createNewBankAccount(String accountNumber, String accountType,String accountName, String accountSSN, double balance) {
                        BankAccount account = null;
                           if (isUserAuthentic) {account = new BankAccount();account.setAccountNumber(accountNumber);account.setAccountType(accountType);account.setAccountOwnerName(accountName);account.setAccountOwnerSSN(accountSSN);account.setBalance(balance);}return account;
                     }

A security researcher found 86 S3 buckets that could be accessed without authentication (CWE-306) and stored data unencrypted (CWE-312). These buckets exposed over 1000 GB of data and 1.6 million files including physical addresses, phone numbers, tax documents, pictures of driver's license IDs, etc. [REF-1296] [REF-1295]

The sensitive information could have been protected by ensuring that the buckets did not have public read access, e.g., by enabling the s3-account-level-public-access-blocks-periodic rule to Block Public Access. In addition, the data could have been encrypted at rest using the appropriate S3 settings, e.g., by enabling server-side encryption using the s3-bucket-server-side-encryption-enabled setting. Other settings are available to further prevent bucket data from being leaked. [REF-1297]