Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2779

2779 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2021-41158 FreeSWITCH vulnerable to SIP digest leak for configured gateways — freeswitch 5.8 Medium2021-10-26
CVE-2021-39224 File path disclosure of shared files in OfficeOnline application — security-advisories 3.5 Low2021-10-25
CVE-2021-39223 File path disclosure of shared files in Richdocuments application — security-advisories 4.8 Medium2021-10-25
CVE-2017-20007 Information Exposure in INGEPAC DA AU — INGEPAC DA AU 5.3 Medium2021-10-25
CVE-2021-42536 Emerson WirelessHART Gateway — WirelessHART Gateway 8.0 High2021-10-22
CVE-2021-31371 Junos OS: QFX5000 Series: Traffic from the network internal to the device (128.0.0.0) may be forwarded to egress interfaces. — Junos OS 5.3 Medium2021-10-19
CVE-2021-31352 SRC Series: NETCONF over SSH allows negotiation of weak ciphers — SRC Series 5.3 Medium2021-10-19
CVE-2021-33727 Siemens SINEC NMS 信息泄露漏洞 — SINEC NMS 6.5 -2021-10-12
CVE-2021-32028 PostgreSQL 信息泄露漏洞 — postgresql 6.5 -2021-10-11
CVE-2021-32029 PostgreSQL 缓冲区错误漏洞 — postgresql 6.5 -2021-10-08
CVE-2021-34702 Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability — Cisco Identity Services Engine Software 4.3 Medium2021-10-06
CVE-2021-41125 HTTP authentication credential leak to target websites in scrapy — scrapy 5.7 Medium2021-10-06
CVE-2021-25486 Samsung SMR 信息泄露漏洞 — Samsung Mobile Devices 2.5 Low2021-10-06
CVE-2021-41124 Splash authentication credentials potentially leaked to target websites in scrapy-splash — scrapy-splash 7.4 High2021-10-05
CVE-2021-41120 Unauthorized access to Credit card form in sylius/paypal-plugin — PayPalPlugin 7.5 High2021-10-05
CVE-2021-41123 Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll — surveysolutions 5.3 Medium2021-10-04
CVE-2021-41092 Docker CLI leaks private registry credentials to registry-1.docker.io — cli 5.4 Medium2021-10-04
CVE-2021-23855 Information disclosure — IndraMotion MLC IndraMotion XLC 8.6 High2021-10-04
CVE-2021-23858 Information disclosure — IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraControl XLC 8.6 High2021-10-04
CVE-2021-41109 LiveQuery publishes user session tokens — parse-server 7.5 High2021-09-30
CVE-2021-41301 ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor — ECS Router Controller ECS (FLASH) 9.8 Critical2021-09-30
CVE-2021-39856 Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via LoadFile — Acrobat Reader 6.5 Medium2021-09-29
CVE-2021-39855 Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via src Parameter — Acrobat Reader 6.5 Medium2021-09-29
CVE-2021-39857 Adobe Acrobat Reader DC Information Disclosure via ActiveX LoadFile — Acrobat Reader 4.3 -2021-09-29
CVE-2021-24661 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure — PostX – Gutenberg Blocks for Post Grid 4.3 -2021-09-27
CVE-2021-22272 ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase. — mybuildings.abb.com 6.5 Medium2021-09-27
CVE-2021-22276 free@home System Access Point FW integrity check can be bypassed. — System Access Point 6.1 Medium2021-09-23
CVE-2021-26333 AMD Chipset Driver Information Disclosure Vulnerability — PSP Driver 5.5 -2021-09-21
CVE-2021-41082 Private message title and participating users leaked in discourse — discourse 7.5 High2021-09-20
CVE-2021-24585 Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure — Timetable and Event Schedule by MotoPress 6.5 -2021-09-20

Vulnerabilities classified as CWE-200 (信息暴露) represent 2779 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.