Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2822

2822 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2024-9541 News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template — News Kit Addons For Elementor 4.3 Medium2024-10-22
CVE-2024-9627 TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure — TeploBot – Telegram Bot for WP 8.6 High2024-10-22
CVE-2024-8852 All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs — All-in-One WP Migration and Backup 5.3 Medium2024-10-22
CVE-2024-45309 OneDev vulnerable to arbitrary file reading for unauthenticated user — onedev 7.5AIHighAI2024-10-21
CVE-2024-9889 ElementInvader Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Information Exposure — ElementInvader Addons for Elementor 4.3 Medium2024-10-19
CVE-2024-42508 Hewlett Packard Enterprise OneView 安全漏洞 — HPE OneView 6.5 -2024-10-18
CVE-2024-49284 WordPress WP SendFox plugin <= 1.3.1 - Sensitive Data Exposure vulnerability — WP SendFox 5.3 Medium2024-10-17
CVE-2024-7417 Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure — Royal Addons for Elementor – Addons and Templates Kit for Elementor 4.3 Medium2024-10-17
CVE-2024-22032 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec — rancher 6.5 Medium2024-10-16
CVE-2017-20194 Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure — Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder 5.3 Medium2024-10-16
CVE-2024-9540 Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template — Sina Extension for Elementor 4.3 Medium2024-10-16
CVE-2020-36835 Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure — WPvivid — Backup, Migration & Staging 4.9 Medium2024-10-16
CVE-2024-47824 Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room — matrix-react-sdk 6.5 -2024-10-15
CVE-2024-47779 Element Web vulnerable to potential exposure of access token via authenticated media — element-web 7.5 -2024-10-15
CVE-2024-47771 Element Desktop vulnerable to potential exposure of access token via authenticated media — element-desktop 7.5 -2024-10-15
CVE-2024-47080 matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver — matrix-js-sdk 7.5 -2024-10-15
CVE-2024-6757 Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function — Elementor Website Builder – more than just a page builder 4.3 Medium2024-10-15
CVE-2024-9546 WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure — WPIDE – File Manager & Code Editor 5.3 Medium2024-10-14
CVE-2024-45739 Sensitive information disclosure in AdminManager logging channel — Splunk Enterprise 4.9 Medium2024-10-14
CVE-2024-45738 Sensitive information disclosure in REST_Calls logging channel — Splunk Enterprise 4.9 Medium2024-10-14
CVE-2024-8902 Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections — Addon Elements for Elementor (formerly Elementor Addon Elements) 4.3 Medium2024-10-12
CVE-2024-9821 Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass — Bot for Telegram on WooCommerce 8.8 High2024-10-12
CVE-2024-9539 GitHub Enterprise Server 安全漏洞 — GitHub Enterprise Server 4.3AIMediumAI2024-10-11
CVE-2024-39527 Junos OS: SRX Series: Low privileged user able to access sensitive information on file system — Junos OS 5.5 Medium2024-10-11
CVE-2024-9538 ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template — ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin 4.3 Medium2024-10-11
CVE-2024-8913 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template — The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce 4.3 Medium2024-10-11
CVE-2024-47868 Several components’ post-process steps may allow arbitrary file leaks in Gradio — gradio 7.5AIHighAI2024-10-10
CVE-2024-45134 Adobe Commerce | Information Exposure (CWE-200) — Adobe Commerce 2.7 Low2024-10-10
CVE-2024-30118 HCL Connections is susceptible to a sensitive information disclosure vulnerability — Connections 3.5 Low2024-10-09
CVE-2024-3656 Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities 8.1 High2024-10-09

Vulnerabilities classified as CWE-200 (信息暴露) represent 2822 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.