2007
The product prevents direct access to a resource containing sensitive information, but it does not
sufficiently limit access to metadata that is derived from the original, sensitive information.
Extended Description
Developers might correctly prevent unauthorized access to a database or other resource containing
sensitive information, but they might not consider that portions of the original information might
also be recorded in metadata, search indices, statistical reports, or other resources. If these
resources are not also restricted, then attackers might be able to extract some or all of the original
information, or otherwise infer some details. For example, an attacker could specify search terms
that are known to be unique to a particular person, or view metadata such as activity or creation
dates in order to identify usage patterns.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 285 Improper Authorization 684
ParentOf 202 Exposure of Sensitive Information Through Data Queries 516
ParentOf 612 Improper Authorization of Index Containing Sensitive
Information