1341
Nature Type ID Name Page
ChildOf 201 Insertion of Sensitive Information Into Sent Data 514
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
At a minimum, attackers can garner information from query
strings that can be utilized in escalating their method of
attack, such as information about the internal workings of
the application or database column names. Successful
exploitation of query string parameter vulnerabilities
could lead to an attacker impersonating a legitimate user,
obtaining proprietary data, or simply executing actions not
intended by the application developers.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
When sensitive information is sent, use the POST method (e.g. registration form).
Observed Examples
Reference Description
CVE-2022-23546 A discussion platform leaks private information in GET requests.
https://www.cve.org/CVERecord?id=CVE-2022-23546
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 729 OWASP Top Ten 2004 Category A8 - Insecure Storage 711 2338
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP23 Exposed Data
CWE-599: Missing Validation of OpenSSL Certificate
CWE Version 4.14
CWE-599: Missing Validation of OpenSSL Certificate
CWE-599: Missing Validation of OpenSSL Certificate