517
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Confidentiality Read Files or Directories
Read Application Data
Sensitive information may possibly be leaked through data
queries accidentally.
Potential Mitigations
Phase: Architecture and Design
This is a complex topic. See the book Translucent Databases for a good discussion of best
practices.
Demonstrative Examples
Example 1:
See the book Translucent Databases for examples.
Observed Examples
Reference Description
CVE-2022-41935 Wiki product allows an adversary to discover filenames via a series of queries
starting with one letter and then iteratively extending the match.
https://www.cve.org/CVERecord?id=CVE-2022-41935
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 967 SFP Secondary Cluster: State Disclosure 888 2403
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
The relationship between CWE-202 and CWE-612 needs to be investigated more closely,
as they may be different descriptions of the same kind of problem. CWE-202 is also being
considered for deprecation, as it is not clearly described and may have been misunderstood by
CWE users. It could be argued that this issue is better covered by CAPEC; an attacker can utilize
their data-query privileges to perform this kind of operation, and if the attacker should not be
allowed to perform the operation - or if the sensitive data should not have been made accessible
at all - then that is more appropriately classified as a separate CWE related to authorization (see
the parent, CWE-1230).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Accidental leaking of sensitive
information through data queries
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE Version 4.14
CWE-203: Observable Discrepancy
CWE-203: Observable Discrepancy