Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2819

2819 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2025-0227 Tsinghua Unigroup Electronic Archives System downLoad.html information disclosure — Electronic Archives System 4.3 Medium2025-01-05
CVE-2025-0226 Tsinghua Unigroup Electronic Archives System downLoad.html download information disclosure — Electronic Archives System 4.3 Medium2025-01-05
CVE-2025-0224 Provision-ISR SH-4050A-2 server.js information disclosure — SH-4050A-2 5.3 Medium2025-01-05
CVE-2024-13110 Beijing Yunfan Internet Technology Yunfan Learning Examination System Exam Answer PaperController.java， information disclosure — Yunfan Learning Examination System 4.3 Medium2025-01-02
CVE-2024-13042 Tsinghua Unigroup Electronic Archives Management System download.html download information disclosure — Electronic Archives Management System 4.3 Medium2024-12-30
CVE-2024-47923 Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor — Mashov 5.3 Medium2024-12-30
CVE-2024-47922 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor — PRI WEB 7.5 High2024-12-30
CVE-2024-56509 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal — changedetection.io 8.6 High2024-12-27
CVE-2024-12984 Amcrest IP2M-841B Web Interface webCapsConfig information disclosure — IP2M-841B 5.3 Medium2024-12-27
CVE-2020-9089 华为产品安全漏洞 — HUAWEI P30 Pro 3.3 Low2024-12-27
CVE-2020-9082 华为产品安全漏洞 — HUAWEI Mate 20 3.5 Low2024-12-27
CVE-2024-45805 OpenCTI leaks support information due to inadequate access control — opencti 4.3 Medium2024-12-26
CVE-2024-12896 Intelbras VIP S4320 G2 Web Interface webCapsConfig information disclosure — VIP S3020 G2 5.3 Medium2024-12-22
CVE-2023-31280 Exposure of Sensitive Information to an Unauthorized Actor — AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices. 5.3 Medium2024-12-20
CVE-2024-11297 Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Page and Post Restriction 5.3 Medium2024-12-20
CVE-2024-54009 Hewlett Packard Enterprise Alletra Storage MP B10000 安全漏洞 — HPE Alletra Storage MP B10000 4.0 Medium2024-12-19
CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse — discourse 2.2 Low2024-12-19
CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse — discourse 7.5 High2024-12-19
CVE-2024-12560 Button Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication — Button Block – Design Stylish, Interactive, and Multi-Functional Buttons 4.3 Medium2024-12-19
CVE-2024-10548 WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API — Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 6.5 Medium2024-12-19
CVE-2024-11291 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction 5.3 Medium2024-12-18
CVE-2024-12340 Animation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template — Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates 4.3 Medium2024-12-18
CVE-2024-11295 Simple Page Access Restriction <= 1.0.29 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Simple Page Access Restriction 5.3 Medium2024-12-18
CVE-2024-12250 Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure — Accept Authorize.NET Payments Using Contact Form 7 5.3 Medium2024-12-18
CVE-2024-10356 ElementsReady Addons for Elementor <= 6.4.8 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates — ElementsReady Addons for Elementor 4.3 Medium2024-12-17
CVE-2024-11280 PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — PPWP – Password Protect Pages 5.3 Medium2024-12-17
CVE-2024-8326 s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure — s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions 8.8 High2024-12-17
CVE-2024-11294 Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Memberful – Membership Plugin 5.3 Medium2024-12-17
CVE-2021-26281 Information disclosure vulnerability in Alarm clock module — Alarm clock 5.5 Medium2024-12-17
CVE-2021-26279 Information disclosure vulnerability in Weather module — Weather 5.9 Medium2024-12-17

Vulnerabilities classified as CWE-200 (信息暴露) represent 2819 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.