1241
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 540 Inclusion of Sensitive Information in Source Code 1251
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Potential Mitigations
Phase: Distribution
Phase: Installation
Remove test code before deploying the application into production.
Demonstrative Examples
Example 1:
Examples of common issues with test applications include administrative functions, listings
of usernames, passwords or session identifiers and information about the system, server or
application configuration.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP28 Unexpected access points
CWE-532: Insertion of Sensitive Information into Log File
Weakness ID : 532
Structure : Simple
Abstraction : Base
Description
Information written to log files can be of a sensitive nature and give valuable guidance to an
attacker or expose sensitive user information.
Extended Description
While logging all information may be helpful during development stages, it is important that
logging levels be set appropriately before a product ships so that sensitive user data and system
information are not accidentally exposed to potential attackers.
Different log files may be produced and stored for:
CWE Version 4.14
CWE-532: Insertion of Sensitive Information into Log File
CWE-532: Insertion of Sensitive Information into Log File