Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2822

2822 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2024-1952 Mattermost 安全漏洞 — Mattermost 3.1 Low2024-02-29
CVE-2024-1949 Mattermost 安全漏洞 — Mattermost 2.6 Low2024-02-29
CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorization — Mattermost 4.3 Medium2024-02-29
CVE-2023-6922 Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure — Under Construction / Maintenance Mode from Acurax 4.3 Medium2024-02-28
CVE-2024-26144 Possible Sensitive Session Information Leak in Active Storage — rails 5.3 Medium2024-02-27
CVE-2024-27905 Apache Aurora: padding oracle can allow construction an authentication cookie — Apache Aurora 9.8 -2024-02-27
CVE-2024-1436 WordPress WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data Exposure — WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit 5.3 Medium2024-02-26
CVE-2024-21501 Apostrophe sanitize-html 安全漏洞 — sanitize-html 5.3 Medium2024-02-24
CVE-2024-25130 Tuleap's mass update clears the permissions on artifact field — tuleap 5.4 Medium2024-02-22
CVE-2024-24817 User can see invitees in events created in PMs and private categories — discourse-calendar 4.3 Medium2024-02-22
CVE-2024-26136 kedi ElectronCord's Discord Token is public — ElectronCord 7.5 High2024-02-20
CVE-2024-0620 PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass — PPWP – Password Protect Pages 5.3 Medium2024-02-20
CVE-2024-0616 Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure — Passster – Password Protect Pages and Content 5.3 Medium2024-02-20
CVE-2024-26132 Element Android can be asked to share internal files. — element-android 4.0 Medium2024-02-20
CVE-2023-52097 Huawei EMUI 安全漏洞 — HarmonyOS 6.5AIMediumAI2024-02-18
CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici — undici 3.9 Low2024-02-16
CVE-2024-1591 Privilege Management for Windows < 24.1 Information Leak — Privilege Management for Windows 3.3 Low2024-02-16
CVE-2023-44253 Fortinet FortiManager 信息泄露漏洞 — FortiManager 4.7 Medium2024-02-15
CVE-2024-0708 Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposure — Landing Page Cat – Coming Soon & Maintenance Pages 5.3 Medium2024-02-15
CVE-2024-25118 Information Disclosure of Hashed Passwords in TYPO3 Backend Forms — typo3 4.3 Medium2024-02-13
CVE-2024-25119 Information Disclosure of Encryption Key in TYPO3 Install Tool — typo3 4.9 Medium2024-02-13
CVE-2024-25120 Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3 — typo3 4.3 Medium2024-02-13
CVE-2024-25121 Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3 — typo3 7.1 High2024-02-13
CVE-2024-21380 Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability — Microsoft Dynamics 365 Business Central 2022 Release Wave 2 8.0 High2024-02-13
CVE-2022-22506 IBM Robotic Process Automation information disclosure — Robotic Process Automation 4.6 Medium2024-02-12
CVE-2024-1431 Netgear R7000 Web Management Interface debuginfo.htm information disclosure — R7000 4.3 Medium2024-02-11
CVE-2024-1430 Netgear R7000 Web Management Interface currentsetting.htm information disclosure — R7000 4.3 Medium2024-02-11
CVE-2024-1406 Linksys WRT54GL Web Management Interface SysInfo1.htm information disclosure — WRT54GL 4.3 Medium2024-02-10
CVE-2024-1405 Linksys WRT54GL Web Management Interface wlaninfo.htm information disclosure — WRT54GL 4.3 Medium2024-02-10
CVE-2024-1404 Linksys WRT54GL Web Management Interface SysInfo.htm information disclosure — WRT54GL 4.3 Medium2024-02-09

Vulnerabilities classified as CWE-200 (信息暴露) represent 2822 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.