885
Demonstrative Examples
Example 1:
The following code contains a logging statement that tracks the contents of records added to a
database by storing them in a log file. Among other values that are stored, the getPassword()
function returns the user-supplied plaintext password associated with the account.
Example Language: C# (Bad)
pass = GetPassword();
...
dbmsLog.WriteLine(id + ":" + pass + ":" + type + ":" + tstamp);
The code in the example above logs a plaintext password to the filesystem. Although many
developers trust the filesystem as a safe storage location for data, it should not be trusted implicitly,
particularly when privacy is a concern.
Example 2:
This code uses location to determine the user's current US State location.
First the application must declare that it requires the ACCESS_FINE_LOCATION permission in the
application's manifest.xml:
Example Language: XML (Bad)
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
During execution, a call to getLastLocation() will return a location based on the application's
location permissions. In this case the application has permission for the most accurate location
possible:
Example Language: Java (Bad)
locationClient = new LocationClient(this, this, this);
locationClient.connect();
Location userCurrLocation;
userCurrLocation = locationClient.getLastLocation();
deriveStateFromCoords(userCurrLocation);
While the application needs this information, it does not need to use the
ACCESS_FINE_LOCATION permission, as the ACCESS_COARSE_LOCATION permission will
be sufficient to identify which US state the user is in.
Example 3:
In 2004, an employee at AOL sold approximately 92 million private customer e-mail addresses to
a spammer marketing an offshore gambling web site [REF-338]. In response to such high-profile
exploits, the collection and management of private data is becoming increasingly regulated.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 857 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 14 - Input Output (FIO)
844 2368
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
CWE Version 4.14
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor