COMMON WEAKNESS ENUMERATIONDraft

CWE-202

Exposure of Sensitive Information Through Data Queries

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Extended description

In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Read Files or DirectoriesRead Application Data

Affected security scopes: Confidentiality

Sensitive information may possibly be leaked through data queries accidentally.

Defence

How is it prevented and fixed?

Architecture and Design

Architecture and design approach

Detail
This is a complex topic. See the [REF-1492] for a good discussion of best practices.