Sensitive Information Exposure
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
This weakness covers any situation where software reveals information to someone who is not entitled to see it. The leak can be direct, such as an API returning a full user record, or indirect, such as error messages, version banners, timing differences, or files left in a web root. Leaked details often enable the next stage of an attack, for example usernames for credential stuffing or internal paths and versions for targeted exploits.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- An API endpoint returns the whole user object, including password hash and internal flags, while the front end displays only the name.
- A production error page shows a full stack trace with framework version, file paths, and a database connection string.
- A .git directory or backup file left in the web root lets anyone download source code and secrets.
How to mitigate it
- Return only the fields a client needs by using explicit response models instead of serializing internal objects.
- Show generic error messages to users and log details server-side only.
- Remove version banners, debug endpoints, and development artifacts from production deployments.
- Classify sensitive data and verify in testing that it never appears in responses, logs, or URLs where it does not belong.
Go deeper
Practice this topic
Test your knowledge of Sensitive Information Exposure with exam-style practice questions.