Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
View on MITREThere are situations where it is critical to remove source code from an area or server. For example, obtaining Perl source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.
Recommendations include removing this script from the web server and moving it to a location not accessible from the Internet.
No detection method information available for this CWE.
The following code uses an include file to store database credentials:
database.inc
The following code uses an include file to store database credentials:
database.inc
The following comment, embedded in a JSP, will be displayed in the resulting HTML output.
Server for Team Awareness Kit (TAK) application includes sensitive tokens in the JavaScript source code.
View DetailsThe LDAP password might be visible in the html code of a rendered page in an IT Asset Management tool.
View DetailsCWE-540: Inclusion of Sensitive Information in Source Code is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Source code on a web server or repository often contains sensitive information and should generally not be accessible to users. There are situations where it is critical to remove source code from an area or server. For example, obtaining Perl source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.
If exploited, CWE-540 (Inclusion of Sensitive Information in Source Code) it can compromise Confidentiality, leading to outcomes such as Read Application Data.
Recommended mitigations for CWE-540 include: Recommendations include removing this script from the web server and moving it to a location not accessible from the Internet.
MITRE documents real CVEs mapped to CWE-540, including CVE-2022-25512, CVE-2022-24867 and CVE-2007-6197. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-540 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.