547
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 867 2011 Top 25 - Weaknesses On the Cusp 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
This entry is intended to be different from resultant information leaks, including those that occur
from improper buffer initialization and reuse, improper encryption, interaction errors, and multiple
interpretation errors. This entry could be regarded as a privacy leak, depending on the type of
information that is leaked.
Relationship
There is a close association between CWE-226 and CWE-212. The difference is partially that
of perspective. CWE-226 is geared towards the final stage of the resource lifecycle, in which
the resource is deleted, eliminated, expired, or otherwise released for reuse. Technically, this
involves a transfer to a different control sphere, in which the original contents of the resource
are no longer relevant. CWE-212, however, is intended for sensitive data in resources that
are intentionally shared with others, so they are still active. This distinction is useful from the
perspective of the CWE research view (CWE-1000).
Terminology
The terms "cleansing" and "scrubbing" have multiple uses within computing. In information
security, these are used for the removal of sensitive data, but they are also used for the
modification of incoming/outgoing data so that it conforms to specifications.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Cross-Boundary Cleansing Infoleak
Related Attack Patterns
CAPEC-ID Attack Pattern Name
168 Windows ::DATA Alternate Data Stream
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
Weakness ID : 213
Structure : Simple
Abstraction : Base
Description
The product's intended functionality exposes information to certain actors in accordance with the
developer's security policy, but this information is regarded as sensitive according to the intended
security policies of other stakeholders such as the product's administrator, users, or others whose
information is being processed.
Extended Description
CWE Version 4.14
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies