CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Base

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Consequences

Confidentiality: Read Files or Directories

How to prevent it

Architecture and Design, Operation, System Configuration: Do not expose file and directory information to the user.

Recent advisories

GHSA-8wcj-mfrc-jx5q — Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
GHSA-85g2-pmrx-r49q — Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read
GHSA-rm97-x556-q36h — sanitize-html Information Exposure vulnerability

All advisories for CWE-538

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor