CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
When handling information, the developer must consider whether the information is regarded as sensitive by different stakeholders, such as users or administrators. Each stakeholder effectively has its own intended security policy that the product is expected to uphold. When a developer does not treat that information as sensitive, this can introduce a vulnerability that violates the expectations of the product's users.
Consequences
- Confidentiality: Read Application Data
Recent advisories
- GHSA-q79r-r9xg-r863 — Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields
- GHSA-v722-jcv5-w7mc — NATS has MQTT plaintext password disclosure
- GHSA-q475-2pgm-7hvp — Apache Airflow: Connection sensitive details exposed to users with READ permissions
- GHSA-r28m-g6j9-r2h5 — Information Exposure vulnerability in Eclipse Jetty
- GHSA-xc67-hjx6-cgg6 — Installation information leak in Eclipse Jetty
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor