883
The product does not properly prevent a person's private, personal information from being
accessed by actors who either (1) are not explicitly authorized to access the information or (2) do
not have the implicit consent of the person about whom the information is collected.
Extended Description
There are many types of sensitive information that products must protect from attackers, including
system data, communications, configuration, business secrets, intellectual property, and an
individual's personal (private) information. Private personal information may include a password,
phone number, geographic location, personal messages, credit card number, etc. Private
information is important to consider whether the person is a user of the product, or part of a data
set that is processed by the product. An exposure of private information does not necessarily
prevent the product from working properly, and in fact the exposure might be intended by the
developer, e.g. as part of data sharing with other organizations. However, the exposure of personal
private information can still be undesirable or explicitly prohibited by law or regulation.
Some types of private information include:
• Government identifiers, such as Social Security Numbers
• Contact information, such as home addresses and telephone numbers
• Geographic location - where the user is (or was)
• Employment history
• Financial data - such as credit card numbers, salary, bank accounts, and debts
• Pictures, video, or audio
• Behavioral patterns - such as web surfing history, when certain activities are performed, etc.
• Relationships (and types of relationships) with others - family, friends, contacts, etc.
• Communications - e-mail addresses, private messages, text messages, chat logs, etc.
• Health - medical conditions, insurance status, prescription records
• Account passwords and other credentials
Some of this information may be characterized as PII (Personally Identifiable Information),
Protected Health Information (PHI), etc. Categories of private information may overlap or vary
based on the intended usage or the policies and practices of a particular industry.
Sometimes data that is not labeled as private can have a privacy implication in a different context.
For example, student identification numbers are usually not considered private because there is no
explicit and publicly-available mapping to an individual student's personal information. However,
if a school generates identification numbers based on student social security numbers, then the
identification numbers should be considered private.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 200 Exposure of Sensitive Information to an Unauthorized Actor 504
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor