549
Reference Description
CVE-2005-0488 Telnet protocol allows servers to obtain sensitive environment information from
clients.
https://www.cve.org/CVERecord?id=CVE-2005-0488
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Notes
Maintenance
This entry is being considered for deprecation. It overlaps many other entries related to
information exposures. It might not be essential to preserve this entry, since other key
stakeholder policies are covered elsewhere, e.g. personal privacy leaks (CWE-359) and systemlevel
exposures that are important to system administrators (CWE-497).
Theoretical
In vulnerability theory terms, this covers cases in which the developer's Intended Policy allows
the information to be made available, but the information might be in violation of a Universal
Policy in which the product's administrator should have control over which information is
considered sensitive and therefore should not be exposed.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Intended information leak
CWE-214: Invocation of Process Using Visible Sensitive Information
Weakness ID : 214
Structure : Simple
Abstraction : Base
Description
A process is invoked with sensitive command-line arguments, environment variables, or other
elements that can be seen by other processes on the operating system.
Extended Description
Many operating systems allow a user to list information about processes that are owned by other
users. Other users could see information such as command line arguments or environment variable
settings. When this data contains sensitive information such as credentials, it might allow other
users to launch an attack against the product or related resources.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-214: Invocation of Process Using Visible Sensitive Information
CWE-214: Invocation of Process Using Visible Sensitive Information