507
the primary weakness, not the disclosure of the memory. In addition, this phrase is also used
frequently in policies and legal documents, but it does not refer to any disclosure of securityrelevant
information.
Information Leak : This is a frequently used term, however the "leak" term has multiple uses
within security. In some cases it deals with the accidental exposure of information from a different
weakness, but in other cases (such as "memory leak"), this deals with improper tracking of
resources, which can lead to exhaustion. As a result, CWE is actively avoiding usage of the "leak"
term.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Detection Methods
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis Inter-application Flow Analysis
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective: Web
Application Scanner Web Services Scanner Database Scanners
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Fuzz Tester Framework-based Fuzzer Automated Monitored Execution Monitored
Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if
it does anything suspicious
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Manual Source Code Review (not inspections)
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Context-configured Source Code Weakness Analyzer Cost effective for partial coverage: Source
code Weakness Analyzer
Effectiveness = High
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Attack Modeling
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
CWE Version 4.14
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor