1196
information about the type of operating system, the applications installed on the system, and the
amount of care that the administrators have put into configuring the program.
Observed Examples
Reference Description
CVE-2021-32638 Code analysis product passes access tokens as a command-line parameter or
through an environment variable, making them visible to other processes via
the ps command.
https://www.cve.org/CVERecord?id=CVE-2021-32638
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 485 7PK - Encapsulation 700 2328
MemberOf 851 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 8 - Exceptional Behavior (ERR)
844 2365
MemberOf 880 CERT C++ Secure Coding Section 12 - Exceptions and
Error Handling (ERR)
868 2379
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms System Information Leak
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR01-J Do not allow exceptions to expose
sensitive information
Software Fault Patterns SFP23 Exposed Data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
170 Web Application Fingerprinting
694 System Location Discovery
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-498: Cloneable Class Containing Sensitive Information
Weakness ID : 498
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-498: Cloneable Class Containing Sensitive Information
CWE-498: Cloneable Class Containing Sensitive Information