COMMON WEAKNESS ENUMERATIONDraft

CWE-202

Exposure of Sensitive Information Through Data Queries

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Genişletilmiş açıklama

In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Read Files or DirectoriesRead Application Data

Etkilenen güvenlik alanları: Confidentiality

Sensitive information may possibly be leaked through data queries accidentally.

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
This is a complex topic. See the [REF-1492] for a good discussion of best practices.