CWE-202 (通过数据查询的敏感数据暴露) — Vulnerability Class 25

CWE-202 represents a statistical inference weakness where attackers deduce sensitive individual data from aggregated query results. This vulnerability typically arises when systems return summary statistics or counts without sufficient noise or differential privacy mechanisms. Attackers exploit this by crafting specific, unique search terms or iterative queries that isolate individual records from the broader dataset, effectively stripping away anonymity. For instance, querying for rare attributes can reveal the existence or details of a specific user. To mitigate this risk, developers must implement robust access controls and apply statistical disclosure control techniques, such as adding random noise to results or enforcing minimum threshold requirements for data release. Ensuring that queries cannot uniquely identify individuals through statistical correlation is essential for maintaining confidentiality in data-intensive applications.