553
Reference Description
CVE-2004-2268 Password exposed in debug information.
https://www.cve.org/CVERecord?id=CVE-2004-2268
CVE-2002-0918 CGI script includes sensitive information in debug messages when an error is
triggered.
https://www.cve.org/CVERecord?id=CVE-2002-0918
CVE-2003-1078 FTP client with debug option enabled shows password to the screen.
https://www.cve.org/CVERecord?id=CVE-2003-1078
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 717 OWASP Top Ten 2007 Category A6 - Information
Leakage and Improper Error Handling
629 2332
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 933 OWASP Top Ten 2013 Category A5 - Security
Misconfiguration
928 2391
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Notes
Relationship
This overlaps other categories.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Infoleak Using Debug Information
OWASP Top Ten 2007 A6 CWE More Specific Information Leakage and Improper
Error Handling
OWASP Top Ten 2004 A10 CWE More Specific Insecure Configuration Management
Software Fault Patterns SFP23 Exposed Data
CWE-219: Storage of File with Sensitive Data Under Web Root
Weakness ID : 219
Structure : Simple
Abstraction : Variant
Description
The product stores sensitive data under the web document root with insufficient access control,
which might make it accessible to untrusted parties.
Extended Description
Besides public-facing web pages and code, products may store sensitive data, code that is not
directly invoked, or other files under the web document root of the web server. If the server is not
configured or otherwise used to prevent direct access to those files, then attackers may obtain this
sensitive data.
Relationships
CWE Version 4.14
CWE-219: Storage of File with Sensitive Data Under Web Root
CWE-219: Storage of File with Sensitive Data Under Web Root