CWE-202: Exposure of Sensitive Information Through Data Queries
BaseDraftExploit Likelihood: Medium
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
View on MITREBack to CWE Lookup
Extended Description
In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
Technical Details
- Structure
- Simple
Applicable To
Not Language-Specific