CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 164

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 59

CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
CAPEC-116 Excavation Likelihood: High · Severity: Medium
CAPEC-169 Footprinting Likelihood: High · Severity: Very Low
CAPEC-224 Fingerprinting Likelihood: High · Severity: Very Low
CAPEC-285 ICMP Echo Request Ping Likelihood: Medium · Severity: Low
CAPEC-287 TCP SYN Scan Severity: Low
CAPEC-290 Enumerate Mail Exchange (MX) Records Severity: Low
CAPEC-291 DNS Zone Transfers Severity: Low
CAPEC-292 Host Discovery Severity: Low
CAPEC-293 Traceroute Route Enumeration Severity: Low
CAPEC-294 ICMP Address Mask Request Severity: Low
CAPEC-295 Timestamp Request Severity: Low
CAPEC-296 ICMP Information Request Severity: Low
CAPEC-297 TCP ACK Ping Severity: Low
CAPEC-298 UDP Ping Severity: Low
CAPEC-299 TCP SYN Ping Severity: Low
CAPEC-300 Port Scanning Severity: Low
CAPEC-301 TCP Connect Scan Severity: Low
CAPEC-302 TCP FIN Scan Severity: Low
CAPEC-303 TCP Xmas Scan Severity: Low
CAPEC-304 TCP Null Scan Severity: Low
CAPEC-305 TCP ACK Scan Severity: Low
CAPEC-306 TCP Window Scan Severity: Low
CAPEC-307 TCP RPC Scan Severity: Low
CAPEC-308 UDP Scan Severity: Low
CAPEC-309 Network Topology Mapping Severity: Low
CAPEC-310 Scanning for Vulnerable Software Severity: Low
CAPEC-312 Active OS Fingerprinting Likelihood: Medium · Severity: Low
CAPEC-313 Passive OS Fingerprinting Likelihood: High · Severity: Low
CAPEC-317 IP ID Sequencing Probe Likelihood: Medium · Severity: Low
CAPEC-318 IP 'ID' Echoed Byte-Order Probe Likelihood: Medium · Severity: Low
CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe Likelihood: Medium · Severity: Low
CAPEC-320 TCP Timestamp Probe Likelihood: Medium · Severity: Low
CAPEC-321 TCP Sequence Number Probe Likelihood: Medium · Severity: Low
CAPEC-322 TCP (ISN) Greatest Common Divisor Probe Likelihood: Medium · Severity: Low
CAPEC-323 TCP (ISN) Counter Rate Probe Likelihood: Medium · Severity: Low
CAPEC-324 TCP (ISN) Sequence Predictability Probe Likelihood: Medium · Severity: Low
CAPEC-325 TCP Congestion Control Flag (ECN) Probe Likelihood: Medium · Severity: Low
CAPEC-326 TCP Initial Window Size Probe Likelihood: Medium · Severity: Low
CAPEC-327 TCP Options Probe Likelihood: Medium · Severity: Low
CAPEC-328 TCP 'RST' Flag Checksum Probe Likelihood: Medium · Severity: Low
CAPEC-329 ICMP Error Message Quoting Probe Likelihood: Medium · Severity: Low
CAPEC-330 ICMP Error Message Echoing Integrity Probe Likelihood: Medium · Severity: Low
CAPEC-472 Browser Fingerprinting Severity: Low
CAPEC-497 File Discovery Likelihood: High · Severity: Very Low
CAPEC-508 Shoulder Surfing Likelihood: High · Severity: High
CAPEC-573 Process Footprinting Likelihood: Low · Severity: Low
CAPEC-574 Services Footprinting Likelihood: Low · Severity: Low
CAPEC-575 Account Footprinting Likelihood: Low · Severity: Low
CAPEC-576 Group Permission Footprinting Likelihood: Low · Severity: Low
CAPEC-577 Owner Footprinting Likelihood: Low · Severity: Low
CAPEC-616 Establish Rogue Location Likelihood: Medium · Severity: Medium
CAPEC-643 Identify Shared Files/Directories on System Likelihood: Medium · Severity: Medium
CAPEC-646 Peripheral Footprinting Likelihood: Low · Severity: Medium
CAPEC-651 Eavesdropping Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-200, as MITRE names them. Credits.

Ask an AI about CWE-200

ChatGPT Claude Google AI Mode

Show the prompt

Explain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

7.5CVE-2016-4992EPSS 2.4%2017-06-08
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers …
5.5CVE-2016-3095EPSS 0.3%2017-06-08
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
5.5CVE-2016-3111EPSS 0.4%2017-06-08
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might…
5.0CVE-2015-2253EPSS 0.6%2017-06-08
The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.
7.5CVE-2015-2251EPSS 1.0%2017-06-08
The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript.
3.3CVE-2017-1125EPSS 0.3%2017-06-07
IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID: 121340.
5.3CVE-2016-9710EPSS 1.6%2017-06-07
IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a file from the local system, which could allow the attacker to ob…
5.5CVE-2016-8939EPSS 0.4%2017-06-07
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compromised. IBM X-Force ID: 118790.
5.5CVE-2016-5960EPSS 0.3%2017-06-07
IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 116171.
5.3CVE-2016-5959EPSS 1.3%2017-06-07
IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser hi…
6.5CVE-2015-7514EPSS 1.6%2017-06-07
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.
7.5CVE-2017-7313EPSS 1.3%2017-06-07
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customer…
6.5CVE-2016-3066EPSS 1.0%2017-06-06
The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.
5.5CVE-2014-9951EPSS 0.4%2017-06-06
In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist.
5.5CVE-2014-9947EPSS 0.4%2017-06-06
In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist.
5.3CVE-2017-8840ExploitEPSS 3.6%2017-06-05
Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 show…
4.3CVE-2017-8441EPSS 0.7%2017-06-05
Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when per…
7.5CVE-2016-8230EPSS 1.1%2017-06-04
In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to Lenovo's servers.
5.9CVE-2017-2309EPSS 0.8%2017-05-30
On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk.
7.5CVE-2017-2304EPSS 1.8%2017-05-30
Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets…
7.5CVE-2017-7338EPSS 1.2%2017-05-27
A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyzer Management View.
5.3CVE-2017-1292EPSS 0.9%2017-05-26
IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the system. IBM X-Force ID: 125153.
7.5CVE-2017-7439EPSS 1.9%2017-05-26
NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages.
5.5CVE-2016-7977EPSS 4.6%2017-05-23
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
7.5CVE-2016-10073ExploitEPSS 84%2017-05-23
The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated …
7.5CVE-2015-6586EPSS 1.3%2017-05-23
The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link…
7.5CVE-2015-5383EPSS 3.8%2017-05-23
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
6.5CVE-2015-5382EPSS 2.9%2017-05-23
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
5.5CVE-2017-9150ExploitEPSS 1.3%2017-05-22
The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive addr…
7.5CVE-2017-9149EPSS 1.8%2017-05-22
Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which allows context-dependent attackers to obtain sensitive information by reading a …
5.5CVE-2017-6987EPSS 1.0%2017-05-22
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "Kernel" component. It allows atta…
5.5CVE-2017-2507EPSS 0.9%2017-05-22
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "Kernel" component. It allows atta…
5.3CVE-2017-6647EPSS 2.7%2017-05-22
A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Temporary File information on an affected system. The vulnerability exists because the …
5.3CVE-2017-6646EPSS 2.7%2017-05-22
A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Order information on an affected system. The vulnerability exists because the affected …
5.3CVE-2017-6645EPSS 2.7%2017-05-22
A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual Temporary Directory information on an affected system. The vulnerability exists…
5.3CVE-2017-6644EPSS 2.7%2017-05-22
A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected softwa…
5.3CVE-2017-6643EPSS 2.7%2017-05-22
A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual Directory information on an affected system. The vulnerability exists because t…
5.3CVE-2017-6642EPSS 2.7%2017-05-22
A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected softwa…
7.5CVE-2017-9134EPSS 1.2%2017-05-21
An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface that will show you the device's serial number, regardless of whether or not you …
7.5CVE-2014-9970EPSS 2.4%2017-05-21
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
7.5CVE-2017-6621EPSS 6.2%2017-05-18
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. …
5.3CVE-2017-4017EPSS 1.0%2017-05-17
User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via the appliance web interface.
5.3CVE-2017-4016EPSS 1.0%2017-05-17
Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find another hole via HTTP response header.
5.3CVE-2017-4013EPSS 1.0%2017-05-17
Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information via HTTP response header.
4.3CVE-2017-7488EPSS 1.4%2017-05-16
Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information about existing usernames.
7.5CVE-2017-6651EPSS 2.0%2017-05-16
A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the ro…
5.5CVE-2015-9001EPSS 0.5%2017-05-16
In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
4.3CVE-2016-9735EPSS 0.7%2017-05-15
IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 119781,
5.5CVE-2017-7495EPSS 0.4%2017-05-15
fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circum…
6.5CVE-2017-5655EPSS 2.1%2017-05-15
In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are readable by any user authenticated on the host.