cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 143

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 59
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-116 Excavation Likelihood: High · Severity: Medium
  • CAPEC-169 Footprinting Likelihood: High · Severity: Very Low
  • CAPEC-224 Fingerprinting Likelihood: High · Severity: Very Low
  • CAPEC-285 ICMP Echo Request Ping Likelihood: Medium · Severity: Low
  • CAPEC-287 TCP SYN Scan Severity: Low
  • CAPEC-290 Enumerate Mail Exchange (MX) Records Severity: Low
  • CAPEC-291 DNS Zone Transfers Severity: Low
  • CAPEC-292 Host Discovery Severity: Low
  • CAPEC-293 Traceroute Route Enumeration Severity: Low
  • CAPEC-294 ICMP Address Mask Request Severity: Low
  • CAPEC-295 Timestamp Request Severity: Low
  • CAPEC-296 ICMP Information Request Severity: Low
  • CAPEC-297 TCP ACK Ping Severity: Low
  • CAPEC-298 UDP Ping Severity: Low
  • CAPEC-299 TCP SYN Ping Severity: Low
  • CAPEC-300 Port Scanning Severity: Low
  • CAPEC-301 TCP Connect Scan Severity: Low
  • CAPEC-302 TCP FIN Scan Severity: Low
  • CAPEC-303 TCP Xmas Scan Severity: Low
  • CAPEC-304 TCP Null Scan Severity: Low
  • CAPEC-305 TCP ACK Scan Severity: Low
  • CAPEC-306 TCP Window Scan Severity: Low
  • CAPEC-307 TCP RPC Scan Severity: Low
  • CAPEC-308 UDP Scan Severity: Low
  • CAPEC-309 Network Topology Mapping Severity: Low
  • CAPEC-310 Scanning for Vulnerable Software Severity: Low
  • CAPEC-312 Active OS Fingerprinting Likelihood: Medium · Severity: Low
  • CAPEC-313 Passive OS Fingerprinting Likelihood: High · Severity: Low
  • CAPEC-317 IP ID Sequencing Probe Likelihood: Medium · Severity: Low
  • CAPEC-318 IP 'ID' Echoed Byte-Order Probe Likelihood: Medium · Severity: Low
  • CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe Likelihood: Medium · Severity: Low
  • CAPEC-320 TCP Timestamp Probe Likelihood: Medium · Severity: Low
  • CAPEC-321 TCP Sequence Number Probe Likelihood: Medium · Severity: Low
  • CAPEC-322 TCP (ISN) Greatest Common Divisor Probe Likelihood: Medium · Severity: Low
  • CAPEC-323 TCP (ISN) Counter Rate Probe Likelihood: Medium · Severity: Low
  • CAPEC-324 TCP (ISN) Sequence Predictability Probe Likelihood: Medium · Severity: Low
  • CAPEC-325 TCP Congestion Control Flag (ECN) Probe Likelihood: Medium · Severity: Low
  • CAPEC-326 TCP Initial Window Size Probe Likelihood: Medium · Severity: Low
  • CAPEC-327 TCP Options Probe Likelihood: Medium · Severity: Low
  • CAPEC-328 TCP 'RST' Flag Checksum Probe Likelihood: Medium · Severity: Low
  • CAPEC-329 ICMP Error Message Quoting Probe Likelihood: Medium · Severity: Low
  • CAPEC-330 ICMP Error Message Echoing Integrity Probe Likelihood: Medium · Severity: Low
  • CAPEC-472 Browser Fingerprinting Severity: Low
  • CAPEC-497 File Discovery Likelihood: High · Severity: Very Low
  • CAPEC-508 Shoulder Surfing Likelihood: High · Severity: High
  • CAPEC-573 Process Footprinting Likelihood: Low · Severity: Low
  • CAPEC-574 Services Footprinting Likelihood: Low · Severity: Low
  • CAPEC-575 Account Footprinting Likelihood: Low · Severity: Low
  • CAPEC-576 Group Permission Footprinting Likelihood: Low · Severity: Low
  • CAPEC-577 Owner Footprinting Likelihood: Low · Severity: Low
  • CAPEC-616 Establish Rogue Location Likelihood: Medium · Severity: Medium
  • CAPEC-643 Identify Shared Files/Directories on System Likelihood: Medium · Severity: Medium
  • CAPEC-646 Peripheral Footprinting Likelihood: Low · Severity: Medium
  • CAPEC-651 Eavesdropping Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-200, as MITRE names them. Credits.

Ask an AI about CWE-200

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.7CVE-2018-1000143EPSS 0.4%

    An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.

  2. 7.8CVE-2018-1000142EPSS 0.4%

    An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.

  3. 8.8CVE-2018-1097EPSS 1.7%

    A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.

  4. 9.8CVE-2018-9126ExploitEPSS 49%

    The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.

  5. 8.2CVE-2018-9275EPSS 1.4%

    In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or Do…

  6. 3.3CVE-2017-6426EPSS 0.4%

    An information disclosure vulnerability in the Qualcomm SPMI driver. Product: Android. Versions: Android kernel. Android ID: A-33644474. References: QC-CR#1106842.

  7. 3.3CVE-2017-6425EPSS 0.4%

    An information disclosure vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-32577085. References: QC-CR#1103689.

  8. 7.5CVE-2016-8486EPSS 0.7%

    An information disclosure vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823691.

  9. 7.5CVE-2016-8485EPSS 0.7%

    An information disclosure vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823681.

  10. 3.3CVE-2016-10236EPSS 0.4%

    An information disclosure vulnerability in the Qualcomm USB driver. Product: Android. Versions: Android kernel. Android ID: A-33280689. References: QC-CR#1102418.

  11. 5.5CVE-2016-10234EPSS 0.5%

    An information disclosure vulnerability in the Qualcomm IPA driver. Product: Android. Versions: Android kernel. Android ID: A-34390017. References: QC-CR#1069060.

  12. 4.3CVE-2017-13269EPSS 0.2%

    A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68818034.

  13. 4.3CVE-2017-13268EPSS 0.2%

    A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67058064.

  14. 5.3CVE-2017-13304EPSS 0.4%

    A information disclosure vulnerability in the Upstream kernel mnh_sm driver. Product: Android. Versions: Android kernel. Android ID: A-70576999.

  15. 5.3CVE-2017-13303EPSS 0.3%

    A information disclosure vulnerability in the Broadcom bcmdhd driver. Product: Android. Versions: Android kernel. Android ID: A-71359108. References: B-V2018010501.

  16. 5.3CVE-2017-13298EPSS 0.3%

    A information disclosure vulnerability in the Android media framework (libhavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-72117051.

  17. 5.3CVE-2017-13297EPSS 0.3%

    A information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71766721.

  18. 5.3CVE-2017-13296EPSS 0.3%

    A information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70897454.

  19. 5.3CVE-2017-13294EPSS 0.3%

    A information disclosure vulnerability in the Android framework (aosp email application). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71814449.

  20. 7.5CVE-2018-6919EPSS 1.4%

    In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, due to insufficient initialization of memory copied to userland, small amounts of kernel memory may be disclosed to userland processes. Unpr…

  21. 9.8CVE-2017-3972EPSS 1.5%

    Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to execute arbitrary code via the server banner leaking potentially sensitive or security …

  22. 7.5CVE-2018-3598EPSS 0.4%

    In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, insufficient validation of parameters from userspace in the camera driver ca…

  23. 4.6CVE-2018-4168EPSS 0.4%

    An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached d…

  24. 5.5CVE-2018-4138EPSS 1.1%

    An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "NVIDIA Graphics Drivers" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.

  25. 7.5CVE-2018-4137EPSS 2.3%

    An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows remote attackers to read autofilled data by leveraging lack…

  26. 2.4CVE-2018-4123EPSS 0.4%

    An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves alarm and timer handling in the "Clock" component. It allows physically proximate attackers to discover the iTunes e-mail address.

  27. 6.5CVE-2018-4117EPSS 3.0%

    An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issu…

  28. 5.5CVE-2018-4104EPSS 1.1%

    An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "Kernel" component. It allows attackers …

  29. 5.5CVE-2018-4093EPSS 1.0%

    An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows atta…

  30. 5.5CVE-2018-4090ExploitEPSS 3.6%

    An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows atta…

  31. 5.5CVE-2018-4084EPSS 1.9%

    An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Wi-Fi" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.

  32. 5.5CVE-2017-7173EPSS 1.4%

    An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.

  33. 5.5CVE-2017-7075EPSS 0.3%

    An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Notes" component. It allows local users to obtain sensitive information by reading search results that contain locked-note content.

  34. 6.5CVE-2017-2493EPSS 1.5%

    An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows re…

  35. 3.3CVE-2017-13877EPSS 0.6%

    An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Sandbox Profiles" component. It allows attackers to determine whether arbitrary files exist via a crafted app.

  36. 4.3CVE-2017-13873EPSS 0.9%

    An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Kernel" component. It allows attackers to obtai…

  37. 5.5CVE-2017-13839EPSS 0.3%

    An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Spotlight" component. It allows local users to see results for other users' files.

  38. 4.3CVE-2018-6849ExploitEPSS 29%

    In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

  39. 5.5CVE-2018-1234EPSS 0.4%

    RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with …

  40. 5.5CVE-2017-17769EPSS 0.1%

    Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver.

  41. 7.8CVE-2017-15852EPSS 0.2%

    Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver.

  42. 5.3CVE-2017-14891EPSS 0.4%

    In the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12, the contents of the stack can get leaked due to an uninitialized variable.

  43. 7.5CVE-2017-14875EPSS 0.5%

    In the handler for the ioctl command VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05-23, a heap overread vulnerability exists.

  44. 7.5CVE-2017-11087EPSS 0.5%

    libOmxVenc in Android for MSM, Firefox OS for MSM, and QRD Android copies the output buffer to an application with the "filled length", which is larger than the output buffer's actual size, leading to an information disclosure problem in t…

  45. 6.5CVE-2018-3817EPSS 1.0%

    When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information.

  46. 4.3CVE-2017-1765EPSS 1.4%

    IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150.

  47. 3.3CVE-2017-1756EPSS 0.4%

    IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856.

  48. 4.3CVE-2017-1705EPSS 1.2%

    IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it can be obtained by viewing the page source. IBM X-Force ID: 134427.

  49. 6.5CVE-2017-9681EPSS 0.4%

    In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if kernel memory address is passed from userspace through iris_vidioc_s_ext_ctrls ioctl, it will print…

  50. 9.6CVE-2016-6658EPSS 0.9%

    Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth…