510
The following is an actual MySQL error statement:
Example Language: SQL (Result)
Warning: mysql_pconnect(): Access denied for user: 'root@localhost' (Using password: N1nj4) in /usr/local/www/wi-data/
includes/database.inc on line 4
The error clearly exposes the database credentials.
Example 6:
This code displays some information on a web page.
Example Language: JSP (Bad)
Social Security Number: <%= ssn %></br>Credit Card Number: <%= ccn %>
The code displays a user's credit card and social security numbers, even though they aren't
absolutely necessary.
Example 7:
The following program changes its behavior based on a debug flag.
Example Language: JSP (Bad)
<% if (Boolean.getBoolean("debugEnabled")) {
%>
User account number: <%= acctNo %>
<%
} %>
The code writes sensitive debug information to the client browser if the "debugEnabled" flag is set
to true .
Example 8:
This code uses location to determine the user's current US State location.
First the application must declare that it requires the ACCESS_FINE_LOCATION permission in the
application's manifest.xml:
Example Language: XML (Bad)
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
During execution, a call to getLastLocation() will return a location based on the application's
location permissions. In this case the application has permission for the most accurate location
possible:
Example Language: Java (Bad)
locationClient = new LocationClient(this, this, this);
locationClient.connect();
Location userCurrLocation;
userCurrLocation = locationClient.getLastLocation();
deriveStateFromCoords(userCurrLocation);
While the application needs this information, it does not need to use the
ACCESS_FINE_LOCATION permission, as the ACCESS_COARSE_LOCATION permission will
be sufficient to identify which US state the user is in.
Observed Examples
CWE Version 4.14
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor