514
[REF-1287]MITRE. "Supplemental Details - 2022 CWE Top 25". 2022 June 8. < https://
cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails
>.
CWE-201: Insertion of Sensitive Information Into Sent Data
Weakness ID : 201
Structure : Simple
Abstraction : Base
Description
The code transmits data to another actor, but a portion of the data includes sensitive information
that should not be accessible to that actor.
Extended Description
Sensitive information could include data that is sensitive in and of itself (such as credentials or
private messages), or otherwise useful in the further exploitation of the system (such as internal file
system structure).
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 200 Exposure of Sensitive Information to an Unauthorized Actor 504
ParentOf 598 Use of GET Request Method With Sensitive Query Strings 1340
CanAlsoBe 202 Exposure of Sensitive Information Through Data Queries 516
CanAlsoBe 209 Generation of Error Message Containing Sensitive
Information