cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 186

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 59
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-116 Excavation Likelihood: High · Severity: Medium
  • CAPEC-169 Footprinting Likelihood: High · Severity: Very Low
  • CAPEC-224 Fingerprinting Likelihood: High · Severity: Very Low
  • CAPEC-285 ICMP Echo Request Ping Likelihood: Medium · Severity: Low
  • CAPEC-287 TCP SYN Scan Severity: Low
  • CAPEC-290 Enumerate Mail Exchange (MX) Records Severity: Low
  • CAPEC-291 DNS Zone Transfers Severity: Low
  • CAPEC-292 Host Discovery Severity: Low
  • CAPEC-293 Traceroute Route Enumeration Severity: Low
  • CAPEC-294 ICMP Address Mask Request Severity: Low
  • CAPEC-295 Timestamp Request Severity: Low
  • CAPEC-296 ICMP Information Request Severity: Low
  • CAPEC-297 TCP ACK Ping Severity: Low
  • CAPEC-298 UDP Ping Severity: Low
  • CAPEC-299 TCP SYN Ping Severity: Low
  • CAPEC-300 Port Scanning Severity: Low
  • CAPEC-301 TCP Connect Scan Severity: Low
  • CAPEC-302 TCP FIN Scan Severity: Low
  • CAPEC-303 TCP Xmas Scan Severity: Low
  • CAPEC-304 TCP Null Scan Severity: Low
  • CAPEC-305 TCP ACK Scan Severity: Low
  • CAPEC-306 TCP Window Scan Severity: Low
  • CAPEC-307 TCP RPC Scan Severity: Low
  • CAPEC-308 UDP Scan Severity: Low
  • CAPEC-309 Network Topology Mapping Severity: Low
  • CAPEC-310 Scanning for Vulnerable Software Severity: Low
  • CAPEC-312 Active OS Fingerprinting Likelihood: Medium · Severity: Low
  • CAPEC-313 Passive OS Fingerprinting Likelihood: High · Severity: Low
  • CAPEC-317 IP ID Sequencing Probe Likelihood: Medium · Severity: Low
  • CAPEC-318 IP 'ID' Echoed Byte-Order Probe Likelihood: Medium · Severity: Low
  • CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe Likelihood: Medium · Severity: Low
  • CAPEC-320 TCP Timestamp Probe Likelihood: Medium · Severity: Low
  • CAPEC-321 TCP Sequence Number Probe Likelihood: Medium · Severity: Low
  • CAPEC-322 TCP (ISN) Greatest Common Divisor Probe Likelihood: Medium · Severity: Low
  • CAPEC-323 TCP (ISN) Counter Rate Probe Likelihood: Medium · Severity: Low
  • CAPEC-324 TCP (ISN) Sequence Predictability Probe Likelihood: Medium · Severity: Low
  • CAPEC-325 TCP Congestion Control Flag (ECN) Probe Likelihood: Medium · Severity: Low
  • CAPEC-326 TCP Initial Window Size Probe Likelihood: Medium · Severity: Low
  • CAPEC-327 TCP Options Probe Likelihood: Medium · Severity: Low
  • CAPEC-328 TCP 'RST' Flag Checksum Probe Likelihood: Medium · Severity: Low
  • CAPEC-329 ICMP Error Message Quoting Probe Likelihood: Medium · Severity: Low
  • CAPEC-330 ICMP Error Message Echoing Integrity Probe Likelihood: Medium · Severity: Low
  • CAPEC-472 Browser Fingerprinting Severity: Low
  • CAPEC-497 File Discovery Likelihood: High · Severity: Very Low
  • CAPEC-508 Shoulder Surfing Likelihood: High · Severity: High
  • CAPEC-573 Process Footprinting Likelihood: Low · Severity: Low
  • CAPEC-574 Services Footprinting Likelihood: Low · Severity: Low
  • CAPEC-575 Account Footprinting Likelihood: Low · Severity: Low
  • CAPEC-576 Group Permission Footprinting Likelihood: Low · Severity: Low
  • CAPEC-577 Owner Footprinting Likelihood: Low · Severity: Low
  • CAPEC-616 Establish Rogue Location Likelihood: Medium · Severity: Medium
  • CAPEC-643 Identify Shared Files/Directories on System Likelihood: Medium · Severity: Medium
  • CAPEC-646 Peripheral Footprinting Likelihood: Low · Severity: Medium
  • CAPEC-651 Eavesdropping Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-200, as MITRE names them. Credits.

Ask an AI about CWE-200

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.9CVE-2016-0887EPSS 3.5%

    EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 all…

  2. 7.1CVE-2016-0090EPSS 3.0%

    Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."

  3. 7.1CVE-2016-0089EPSS 3.3%

    Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."

  4. 5.3CVE-2016-3170EPSS 2.1%

    The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email addres…

  5. 6.5CVE-2016-2166EPSS 4.3%

    The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavai…

  6. 5.3CVE-2016-2140EPSS 2.1%

    The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qc…

  7. 5.3CVE-2015-8537EPSS 1.9%

    app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.

  8. 4.3CVE-2015-8473EPSS 1.7%

    The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from…

  9. 4.3CVE-2015-8399ExploitEPSS 60%

    Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.

  10. 5.3CVE-2015-7528EPSS 2.1%

    Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.

  11. 5.1CVE-2015-7502EPSS 0.3%

    Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequentl…

  12. 5.3CVE-2014-9759EPSS 1.9%

    Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.

  13. 7.5CVE-2016-2164EPSS 7.0%

    The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attac…

  14. 7.5CVE-2016-0783EPSS 7.1%

    The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the curren…

  15. 3.1CVE-2016-2513EPSS 3.3%

    The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

  16. 6.2CVE-2015-5969EPSS 0.4%

    The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package before 10.0.22-2.21.2 in openSUSE 13.2 and before 10.0.22-3.1 …

  17. 9.8CVE-2016-0791EPSS 2.7%

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

  18. 5.3CVE-2016-0790EPSS 2.1%

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

  19. 5.9CVE-2015-2774EPSS 1.9%

    Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka …

  20. 5.3CVE-2016-3973EPSS 2.4%

    The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~w…

  21. 6.8CVE-2016-1563EPSS 0.6%

    NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  22. 7.5CVE-2016-0871EPSS 1.5%

    Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.

  23. 7.5CVE-2016-0793ExploitEPSS 15%

    Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META…

  24. 5.3CVE-2016-1787EPSS 1.8%

    Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors.

  25. 5.4CVE-2016-1786EPSS 1.2%

    The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed URL, bypass the Same Origin Po…

  26. 6.5CVE-2016-1785EPSS 1.5%

    The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive informa…

  27. 4.3CVE-2016-1780EPSS 1.2%

    WebKit in Apple iOS before 9.3 does not prevent hidden web views from reading orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment via a crafted web site.

  28. 6.5CVE-2016-1779EPSS 2.8%

    WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.

  29. 4.3CVE-2016-1772EPSS 1.2%

    The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors.

  30. 4.3CVE-2016-1764EPSS 2.6%

    The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL.

  31. 3.3CVE-2016-1758EPSS 0.8%

    The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app.

  32. 3.3CVE-2016-1748EPSS 1.0%

    IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.

  33. 6.5CVE-2015-2286EPSS 2.0%

    lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer lo…

  34. 3.4CVE-2016-3155EPSS 0.3%

    Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors.

  35. 6.5CVE-2016-1994EPSS 1.9%

    HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors.

  36. 6.5CVE-2016-1992EPSS 1.8%

    HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors.

  37. 6.5CVE-2016-1967EPSS 2.2%

    Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that l…

  38. 4.3CVE-2016-1955EPSS 2.0%

    Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME elem…

  39. 5.5CVE-2016-0831EPSS 0.5%

    The getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java in Telephony in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not check for the READ_PHONE_STATE permission, which allows attackers to obta…

  40. 7.5CVE-2016-0829EPSS 0.7%

    The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not initialize a certain output data structure, whi…

  41. 7.5CVE-2016-0828EPSS 0.7%

    The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obta…

  42. 5.3CVE-2016-0825EPSS 0.5%

    The Widevine Trusted Application in Android 6.0.1 before 2016-03-01 allows attackers to obtain sensitive TrustZone secure-storage information by leveraging kernel access, as demonstrated by obtaining Signature or SignatureOrSystem access, …

  43. 5.3CVE-2016-0824EPSS 0.6%

    libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via crafted Bitstream data, as demonstrated by obtaining Signature o…

  44. 4.0CVE-2016-0823EPSS 0.3%

    The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android inter…

  45. 4.3CVE-2016-1562EPSS 0.9%

    The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter.

  46. 7.1CVE-2016-1360EPSS 0.3%

    Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw…

  47. 5.3CVE-2015-6485EPSS 1.2%

    Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01, and LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400, and Sage 3030M RTUs with firmware before C3414-500-S02J2, allow remote attackers to obtain sensitive…

  48. 4.3CVE-2016-0886EPSS 1.8%

    EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcp_member API call.

  49. 7.5CVE-2016-1325EPSS 4.0%

    The administration interface on Cisco DPC3939B and DPC3941 devices allows remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug ID CSCus49506.

  50. 3.1CVE-2016-0125EPSS 12%

    Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka "Microsoft Edge Information Disclosure Vulnerability."