Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2779

2779 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2024-43237 WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerability — WordPress Tag Cloud Plugin – Tag Groups 5.3 Medium2024-09-25
CVE-2024-8516 Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Information Exposure — Themesflat Addons For Elementor 4.3 Medium2024-09-25
CVE-2024-8483 MAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure — MAS Static Content 4.3 Medium2024-09-25
CVE-2024-7426 Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path Disclosure — Community by PeepSo – Download from PeepSo.com 5.3 Medium2024-09-25
CVE-2024-8801 Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure — Happy Addons for Elementor 4.3 Medium2024-09-24
CVE-2023-5359 W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext — W3 Total Cache 3.7 Low2024-09-24
CVE-2024-42351 Possible Data Tampering & Loss of Public Datasets in Galaxy — galaxy 6.5 Medium2024-09-20
CVE-2024-8612 Qemu-kvm: information leak in virtio devices 3.8 Low2024-09-20
CVE-2024-47060 Unauthorized Access After Organization or Project Deactivation in Zitadel — zitadel 4.3 Medium2024-09-19
CVE-2024-47059 Users enumeration - weak password login — Mautic 4.3 Medium2024-09-18
CVE-2024-46979 Data leak of notification filters of users in XWiki Platform — xwiki-platform 5.3 Medium2024-09-18
CVE-2024-46987 Arbitrary path traversal in Camaleon CMS — camaleon-cms 7.7 High2024-09-18
CVE-2024-8969 The SYSCOM Group OMFLOW - Exposure of Sensitive Data — OMFLOW 6.5 Medium2024-09-18
CVE-2024-45811 server.fs.deny bypassed when using ?import&raw in vite — vite 4.8 Medium2024-09-17
CVE-2024-8780 The SYSCOM Group OMFLOW - Improper Authorization for Data Query Function — OMFLOW 6.5 Medium2024-09-16
CVE-2024-8777 The SYSCOM Group OMFLOW - Information Leakage — OMFLOW 7.5 High2024-09-16
CVE-2024-6544 Custom Post Limits <= 4.4.1 - Unauthenticated Full Path Disclosure — Custom Post Limits 5.3 Medium2024-09-13
CVE-2024-8097 Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level — Payara Server 6.5AIMediumAI2024-09-11
CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02 — SO Planning 6.2AIMediumAI2024-09-11
CVE-2024-31490 Fortinet FortiSandbox 信息泄露漏洞 — FortiSandbox 4.2 Medium2024-09-10
CVE-2024-37991 Siemens SIMATIC 信息泄露漏洞 — SIMATIC Reader RF610R CMIIT 5.3 Medium2024-09-10
CVE-2024-8538 Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure — Big File Uploads – Increase Maximum File Upload Size 4.3 Medium2024-09-07
CVE-2024-45039 gnark's Groth16 commitment extension unsound for more than one commitment — gnark 6.2 Medium2024-09-06
CVE-2024-45040 gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge property — gnark 5.9 Medium2024-09-06
CVE-2024-7415 Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure — Remember Me Controls 5.3 Medium2024-09-06
CVE-2024-8461 D-Link DNS-320 Web Management Interface discovery.cgi information disclosure — DNS-320 5.3 Medium2024-09-05
CVE-2024-8460 D-Link DNS-320 Web Management Interface widget_api.cgi information disclosure — DNS-320 3.7 Low2024-09-05
CVE-2024-6835 Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form — Ivory Search – WordPress Search Plugin 5.3 Medium2024-09-05
CVE-2024-20503 Cisco Duo Epic for Hyperdrive Information Disclosure Vulnerability — Cisco Duo Authentication for Epic 5.5 Medium2024-09-04
CVE-2024-8106 The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure — The Ultimate WordPress Toolkit – WP Extended 6.5 Medium2024-09-04

Vulnerabilities classified as CWE-200 (信息暴露) represent 2779 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.