548
When handling information, the developer must consider whether the information is regarded as
sensitive by different stakeholders, such as users or administrators. Each stakeholder effectively
has its own intended security policy that the product is expected to uphold. When a developer
does not treat that information as sensitive, this can introduce a vulnerability that violates the
expectations of the product's users.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 200 Exposure of Sensitive Information to an Unauthorized Actor 504
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 199 Information Management Errors 2312
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Demonstrative Examples
Example 1:
This code displays some information on a web page.
Example Language: JSP (Bad)
Social Security Number: <%= ssn %></br>Credit Card Number: <%= ccn %>
The code displays a user's credit card and social security numbers, even though they aren't
absolutely necessary.
Observed Examples
Reference Description
CVE-2002-1725 Script calls phpinfo()
https://www.cve.org/CVERecord?id=CVE-2002-1725
CVE-2004-0033 Script calls phpinfo()
https://www.cve.org/CVERecord?id=CVE-2004-0033
CVE-2003-1181 Script calls phpinfo()
https://www.cve.org/CVERecord?id=CVE-2003-1181
CVE-2004-1422 Script calls phpinfo()
https://www.cve.org/CVERecord?id=CVE-2004-1422
CVE-2004-1590 Script calls phpinfo()
https://www.cve.org/CVERecord?id=CVE-2004-1590
CVE-2003-1038 Product lists DLLs and full pathnames.
https://www.cve.org/CVERecord?id=CVE-2003-1038
CVE-2005-1205 Telnet protocol allows servers to obtain sensitive environment information from
clients.
https://www.cve.org/CVERecord?id=CVE-2005-1205
CWE Version 4.14
CWE-214: Invocation of Process Using Visible Sensitive Information
CWE-214: Invocation of Process Using Visible Sensitive Information