CWE WEAKNESSES / CWE-202
CWE-202
Exposure of Sensitive Information Through Data Queries
Base EXPLOIT LIKELIHOOD: MEDIUM
What it is
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
Impact
| Confidentiality | Read Files or Directories, Read Application Data |
Mitigations
- [Architecture and Design] This is a complex topic. See the [REF-1492] for a good discussion of best practices.
Real-world CVE examples
- CVE-2022-41935 — Wiki product allows an adversary to discover filenames via a series of queries starting with one letter and then iteratively extending the match.
Related weaknesses
Test & detect
Browse all common weaknesses, check related exploited CVEs, or map to ATT&CK techniques.
Source: MITRE CWE. View on cwe.mitre.org →