551
Reference Description
CVE-2004-1058 Kernel race condition allows reading of environment variables of a process that
is still spawning.
https://www.cve.org/CVERecord?id=CVE-2004-1058
CVE-2021-32638 Code analysis product passes access tokens as a command-line parameter or
through an environment variable, making them visible to other processes via
the ps command.
https://www.cve.org/CVERecord?id=CVE-2021-32638
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Notes
Research Gap
Under-studied, especially environment variables.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Process information infoleak to other
processes
Software Fault Patterns SFP23 Exposed Data
CWE-215: Insertion of Sensitive Information Into Debugging Code
Weakness ID : 215
Structure : Simple
Abstraction : Base
Description
The product inserts sensitive information into debugging code, which could expose this information
if the debugging code is not disabled in production.
Extended Description
When debugging, it may be necessary to report detailed information to the programmer. However,
if the debugging code is not disabled when the product is operating in a production environment,
then this sensitive information may be exposed to attackers.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-215: Insertion of Sensitive Information Into Debugging Code
CWE-215: Insertion of Sensitive Information Into Debugging Code