CWE-213 (故意性的信息暴露) — Vulnerability Class 28

CWE-213 represents a critical design flaw where software exposes sensitive data because the developer’s security policies conflict with those of other stakeholders, such as administrators or end-users. This weakness typically arises when a system correctly implements its own internal controls but fails to recognize that the same data is classified as confidential under external regulatory or organizational mandates. Exploitation often occurs indirectly, as the application inadvertently leaks private information to unauthorized parties who rely on their own distinct security frameworks to identify the exposure. To prevent this vulnerability, developers must adopt a holistic security approach that integrates diverse policy requirements during the design phase. This involves conducting thorough threat modeling that considers all potential actors and their specific data handling expectations, ensuring that internal logic does not inadvertently violate external compliance standards or user privacy agreements.