Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2752

2752 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2024-54119 Huawei HarmonyOS 安全漏洞 — HarmonyOS 6.2 Medium2024-12-12
CVE-2024-54117 HUAWEI HarmonyOS 安全漏洞 — HarmonyOS 6.2 Medium2024-12-12
CVE-2024-12564 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3 — CDE inWEB SDK 5.3 -2024-12-12
CVE-2024-12329 Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure — Essential Real Estate 4.3 Medium2024-12-12
CVE-2024-12255 Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure — Accept Stripe Payments Using Contact Form 7 5.3 Medium2024-12-12
CVE-2024-11351 Restrict – membership, site, content and user access restrictions for WordPress <= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Restrict – membership, site, content and user access restrictions for WordPress 5.3 Medium2024-12-11
CVE-2024-11008 Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Members – Membership & User Role Editor Plugin 5.3 Medium2024-12-11
CVE-2024-53244 Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameter — Splunk Enterprise 5.7 Medium2024-12-10
CVE-2024-53243 Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway — Splunk Enterprise 4.3 Medium2024-12-10
CVE-2024-53245 Information Disclosure due to Username Collision with a Role that has the same Name as the User — Splunk Enterprise 3.1 Low2024-12-10
CVE-2024-11106 Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Simple Restrict 5.3 Medium2024-12-10
CVE-2024-54151 Directus allows unauthenticated access to WebSocket events and operations — directus 7.5 High2024-12-09
CVE-2024-54137 liboqs has a correctness error in HQC decapsulation — liboqs 7.4 High2024-12-06
CVE-2024-11292 WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — WP Private Content Plus 5.3 Medium2024-12-06
CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material — solana-web3.js 8.6 -2024-12-04
CVE-2024-53862 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode — argo-workflows 9.1 -2024-12-02
CVE-2024-11961 Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure — Jeewms 5.3 Medium2024-11-28
CVE-2024-53858 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli — cli 6.5 Medium2024-11-27
CVE-2024-53859 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace — go-gh 6.5 Medium2024-11-27
CVE-2024-52323 Sensitive Data Exposure — Analytics Plus 8.1 High2024-11-27
CVE-2024-11083 ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 5.3 Medium2024-11-27
CVE-2017-18307 Information Exposure in Kernel — Snapdragon 8.4 High2024-11-26
CVE-2017-18306 Information Exposure in Camera Driver — Snapdragon 8.4 High2024-11-26
CVE-2024-8899 Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template — Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress 4.3 Medium2024-11-26
CVE-2024-11265 Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure — EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time 4.3 Medium2024-11-23
CVE-2024-7391 ChargePoint Home Flex Bluetooth Low Energy Information Disclosure Vulnerability — Home Flex 5.7 -2024-11-22
CVE-2024-8929 Leak partial content of the heap through heap buffer over-read in mysqlnd — PHP 5.8 Medium2024-11-22
CVE-2024-11088 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor — Simple Membership 5.3 Medium2024-11-21
CVE-2024-11089 Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Anonymous Restricted Content 5.3 Medium2024-11-21
CVE-2024-9542 Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template — Sky Addons – Elementor Addons with Widgets & Templates 4.3 Medium2024-11-21

Vulnerabilities classified as CWE-200 (信息暴露) represent 2752 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.