CWE-200: Sensitive Information Exposure Vulnerability Analysis and Mitigation

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Description CWE-200 is a software vulnerability where a product exposes sensitive information to an entity that is not explicitly authorized to access that information. Sensitive information includes personal/private information (such as personal messages, financial data, health records, location, or contact details), system status and environment (such as the operating system and installed packages), trade secrets and intellectual property, network status and configuration, the product's own code or internal state, metadata (such as connection logs or message headers), and indirect information (such as observable differences between two internal operations). Impact Impact: Confidentiality Potential Consequences: Reading application data Remediation Architecture and Design: Adopt a "Separation of Privilege" strategy. Divide the system into "secure" zones where trust boundaries can be clearly defined. Do not place sensitive data outside the trust boundary, and be cautious when interacting with components outside the trust boundary. Ensure that adequate isolation is built into the system design and that this isolation supports and reinforces the separation of privileges. Architects and designers should follow the principle of least privilege, determining when privileges are appropriate and when they should be relinquished. Example Code Example 1 Example 2 Example 3 Example 4 Example 5 Example 6 Example 7 Example 8 Related CVE List CVE-2022-31162: Rust library leaks OAuth client details in application debug logs CVE-2021-25476: Digital Rights Management (DRM) feature allows mobile platform to leak pointer information, simplifying ASLR bypass CVE-2001-1483: Valid username enumeration based on inconsistent responses CVE-2001-1528: Account number enumeration via inconsistent response CVE-2004-2150: User enumeration via differences in error messages CVE-2005-1205: Telnet protocol allows server to obtain sensitive environment information from the client CVE-2002-1725: Script invocation of phpinfo() reveals system configuration to web users CVE-2002-0515: Product sets different TTLs when ports are filtered versus unfiltered, allowing remote attackers to identify filtered ports by comparing TTLs CVE-2004-0778: Version control system allows remote attackers to determine the existence of arbitrary files and directories via -X commands (used to substitute history files), resulting in different error messages being returned CVE-2000-1117: Virtual machine allows malicious website operators to determine the existence of files on the client by measuring the execution time of the getSystemResource method CVE-2003-0190: Program sends an error message immediately when a user does not exist, allowing remote attackers to determine valid usernames via timing attacks CVE-2008-2049: POP3 server leaks passwords in error messages after sending multiple APOP commands. Likely caused by another weakness CVE-2007-5172: Program leaks passwords in error messages if the attacker can trigger certain database errors CVE-2008-4638: Composite: An application running with high privileges (CWE-250) allows users to specify restricted files for processing, generating parse errors that leak file contents (CWE-200) CVE-2007-1499: Direct library file requests trigger path name leaks in error messages within web applications CVE-2005-0603: Malformed regular expression syntax causes information leakage in error messages CVE-2004-2268: Password exposed in debug messages CVE-2003-1078: FTP client with debug options enabled displays passwords on the screen CVE-2022-0708: Collaboration platform fails to sanitize team emails in responses, allowing email addresses to be leaked

Goal Reached Thanks to every supporter — we hit 100%!

CWE-200: Sensitive Information Exposure Vulnerability Analysis and Mitigation