CWE-202: Exposure of Sensitive Information Through Data Queries
Description
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
In situations where data should not be tied to individual users, but a large number of users should be able to make queries that scrub the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Medium
- Status
- Draft
Common consequences
- Confidentiality
Read Files or Directories; Read Application Data
Sensitive information may possibly be leaked through data queries accidentally.
Potential mitigations
- Architecture and Design
This is a complex topic. See the for a good discussion of best practices.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.