目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-212 敏感数据的不恰当跨边界移除 类漏洞列表 62

CWE-212 敏感数据的不恰当跨边界移除 类弱点 62 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-212 属于信息泄露类漏洞，指产品在存储或传输资源前未彻底清除敏感数据。攻击者常通过访问被遗弃的文件、数据库记录或网络包，直接获取这些残留的机密信息，从而实施身份盗窃或数据滥用。开发者应避免此风险，需在数据复用或销毁前，采用安全擦除技术彻底清除敏感内容，并严格限制资源访问权限，确保未授权方无法读取残留数据。

MITRE CWE 官方描述
CWE：CWE-212 存储或传输前未适当移除敏感信息 英文：产品存储、传输或共享包含敏感信息的资源，但在将资源提供给未授权行为者之前，未适当移除该信息。 可能包含敏感数据的资源包括文档、数据包、消息、数据库等。虽然这些数据对于共享该资源的个别用户或小范围用户可能有用，但在将资源分享给受信任组之外的人员之前，可能需要移除这些数据。移除过程有时称为清理（cleansing）或擦除（scrubbing）。例如，用于编辑文档的产品可能不会移除敏感数据，如审阅者注释或文档存储的本地路径名。或者，代理可能在向 Internet 站点发出传出请求之前，未从标头中移除内部 IP 地址。
常见影响 (1)
Confidentiality Read Files or Directories, Read Application Data
Sensitive data may be exposed to an unauthorized actor in another control sphere. This may have a wide range of secondary consequences that will depend on what data is exposed. One possibility is the exposure of system data - such as file l…
缓解措施 (5)
Requirements Clearly specify which information should be regarded as private or sensitive, and require that the product offers functionality that allows the user to cleanse the sensitive information from the resource before it is published or exported to other parties.
Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Implementation, Operation Some tools can automatically analyze documents to redact, strip, or "sanitize" private information, although some human review might be necessary. Tools may vary in terms of which document formats can be processed. When calling an external program to automatically generate or convert documents, invoke the program with any available options that avoid generating sensitive metada…
Implementation Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Effectiveness: Defense in Depth
Implementation Avoid errors related to improper resource shutdown or release (CWE-404), which may leave the sensitive data within the resource if it is in an incomplete state.
代码示例 (1)
This code either generates a public HTML user information page or a JSON response containing the same user information.
// API flag, output JSON if set $json = $_GET['json'] $username = $_GET['user'] if(!$json) { $record = getUserRecord($username); foreach($record as $fieldName => $fieldValue) { if($fieldName == "email_address") { // skip displaying user emails continue; } else{ writeToHtmlPage($fieldName,$fieldValue); } } } else { $record = getUserRecord($username); echo json_encode($record); }
Bad · PHP
CVE ID 标题 CVSS 风险等级 Published
CVE-2017-15113 Red Hat oVirt Engine 信息泄露漏洞 — ovirt-engine 5.9 - 2018-07-27
CVE-2018-1062 Red Hat oVirt 安全漏洞 — oVirt 4.4 - 2018-03-06

CWE-212（敏感数据的不恰当跨边界移除） 是常见的弱点类别，本平台收录该类弱点关联的 62 条 CVE 漏洞。