516
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Accidental leaking of sensitive
information through sent data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
12 Choosing Message Identifier
217 Exploiting Incorrectly Configured SSL/TLS
612 WiFi MAC Address Tracking
613 WiFi SSID Tracking
618 Cellular Broadcast Message Request
619 Signal Strength Tracking
621 Analysis of Packet Timing and Sizes
622 Electromagnetic Side-Channel Attack
623 Compromising Emanations Attack
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-202: Exposure of Sensitive Information Through Data Queries
Weakness ID : 202
Structure : Simple
Abstraction : Base
Description
When trying to keep information confidential, an attacker can often infer some of the information by
using statistics.
Extended Description
In situations where data should not be tied to individual users, but a large number of users should
be able to make queries that "scrub" the identity of users, it may be possible to get information
about a user -- e.g., by specifying search terms that are known to be unique to that user.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1230 Exposure of Sensitive Information Through Metadata 2006
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
CWE Version 4.14
CWE-202: Exposure of Sensitive Information Through Data Queries
CWE-202: Exposure of Sensitive Information Through Data Queries