A user is able to view the backup files of a website, while browsing the site.
-
Sensitive Information Disclosure.
-
Configuration Management.
-
Input validation.
-
Vulnerable Cookie.
Configuration Management weakness means backup files weren't properly protected or removed from the web server. This allows users to access sensitive backup files directly. Sensitive Information Disclosure is the consequence, not the vulnerability itself. Input validation filters user input, and vulnerable cookie refers to cookie security issues.
Being able to browse to and view a website's backup files (e.g., .bak, .old, .zip archives left in a web-accessible directory) is a classic Configuration Management vulnerability — the server/application wasn't properly configured to restrict access to non-production artifacts, default files, or backups, exposing them to any visitor. This differs from generic Sensitive Information Disclosure (a broader category the backup exposure is really a specific cause of, per this question's taxonomy) and has nothing to do with Input validation (which concerns sanitizing user-supplied data) or a Vulnerable Cookie (session/cookie handling issues).