cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 198

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 59
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-116 Excavation Likelihood: High · Severity: Medium
  • CAPEC-169 Footprinting Likelihood: High · Severity: Very Low
  • CAPEC-224 Fingerprinting Likelihood: High · Severity: Very Low
  • CAPEC-285 ICMP Echo Request Ping Likelihood: Medium · Severity: Low
  • CAPEC-287 TCP SYN Scan Severity: Low
  • CAPEC-290 Enumerate Mail Exchange (MX) Records Severity: Low
  • CAPEC-291 DNS Zone Transfers Severity: Low
  • CAPEC-292 Host Discovery Severity: Low
  • CAPEC-293 Traceroute Route Enumeration Severity: Low
  • CAPEC-294 ICMP Address Mask Request Severity: Low
  • CAPEC-295 Timestamp Request Severity: Low
  • CAPEC-296 ICMP Information Request Severity: Low
  • CAPEC-297 TCP ACK Ping Severity: Low
  • CAPEC-298 UDP Ping Severity: Low
  • CAPEC-299 TCP SYN Ping Severity: Low
  • CAPEC-300 Port Scanning Severity: Low
  • CAPEC-301 TCP Connect Scan Severity: Low
  • CAPEC-302 TCP FIN Scan Severity: Low
  • CAPEC-303 TCP Xmas Scan Severity: Low
  • CAPEC-304 TCP Null Scan Severity: Low
  • CAPEC-305 TCP ACK Scan Severity: Low
  • CAPEC-306 TCP Window Scan Severity: Low
  • CAPEC-307 TCP RPC Scan Severity: Low
  • CAPEC-308 UDP Scan Severity: Low
  • CAPEC-309 Network Topology Mapping Severity: Low
  • CAPEC-310 Scanning for Vulnerable Software Severity: Low
  • CAPEC-312 Active OS Fingerprinting Likelihood: Medium · Severity: Low
  • CAPEC-313 Passive OS Fingerprinting Likelihood: High · Severity: Low
  • CAPEC-317 IP ID Sequencing Probe Likelihood: Medium · Severity: Low
  • CAPEC-318 IP 'ID' Echoed Byte-Order Probe Likelihood: Medium · Severity: Low
  • CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe Likelihood: Medium · Severity: Low
  • CAPEC-320 TCP Timestamp Probe Likelihood: Medium · Severity: Low
  • CAPEC-321 TCP Sequence Number Probe Likelihood: Medium · Severity: Low
  • CAPEC-322 TCP (ISN) Greatest Common Divisor Probe Likelihood: Medium · Severity: Low
  • CAPEC-323 TCP (ISN) Counter Rate Probe Likelihood: Medium · Severity: Low
  • CAPEC-324 TCP (ISN) Sequence Predictability Probe Likelihood: Medium · Severity: Low
  • CAPEC-325 TCP Congestion Control Flag (ECN) Probe Likelihood: Medium · Severity: Low
  • CAPEC-326 TCP Initial Window Size Probe Likelihood: Medium · Severity: Low
  • CAPEC-327 TCP Options Probe Likelihood: Medium · Severity: Low
  • CAPEC-328 TCP 'RST' Flag Checksum Probe Likelihood: Medium · Severity: Low
  • CAPEC-329 ICMP Error Message Quoting Probe Likelihood: Medium · Severity: Low
  • CAPEC-330 ICMP Error Message Echoing Integrity Probe Likelihood: Medium · Severity: Low
  • CAPEC-472 Browser Fingerprinting Severity: Low
  • CAPEC-497 File Discovery Likelihood: High · Severity: Very Low
  • CAPEC-508 Shoulder Surfing Likelihood: High · Severity: High
  • CAPEC-573 Process Footprinting Likelihood: Low · Severity: Low
  • CAPEC-574 Services Footprinting Likelihood: Low · Severity: Low
  • CAPEC-575 Account Footprinting Likelihood: Low · Severity: Low
  • CAPEC-576 Group Permission Footprinting Likelihood: Low · Severity: Low
  • CAPEC-577 Owner Footprinting Likelihood: Low · Severity: Low
  • CAPEC-616 Establish Rogue Location Likelihood: Medium · Severity: Medium
  • CAPEC-643 Identify Shared Files/Directories on System Likelihood: Medium · Severity: Medium
  • CAPEC-646 Peripheral Footprinting Likelihood: Low · Severity: Medium
  • CAPEC-651 Eavesdropping Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-200, as MITRE names them. Credits.

Ask an AI about CWE-200

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2015-3320EPSS 0.3%

    Lenovo USB Enhanced Performance Keyboard software before 2.0.2.2 includes active debugging code in SKHOOKS.DLL, which allows local users to obtain keypress information by accessing debug output.

  2. –CVE-2015-1314EPSS 0.5%

    The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.

  3. –CVE-2015-3319EPSS 2.8%

    Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

  4. –CVE-2015-3044EPSS 9.4%

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vect…

  5. –CVE-2015-3040EPSS 4.8%

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protectio…

  6. –CVE-2015-0357EPSS 5.2%

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protectio…

  7. –CVE-2015-3293EPSS 1.0%

    FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.

  8. –CVE-2015-0844EPSS 2.3%

    The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

  9. –CVE-2015-2935EPSS 2.4%

    MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by…

  10. –CVE-2015-1415EPSS 0.4%

    The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by…

  11. –CVE-2015-1148EPSS 1.5%

    Screen Sharing in Apple OS X before 10.10.3 stores the password of a user in a log file, which might allow context-dependent attackers to obtain sensitive information by reading this file.

  12. –CVE-2015-1147EPSS 1.6%

    Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network.

  13. –CVE-2015-1128EPSS 1.4%

    The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitive browsing-history information via vectors involving push-notification requests.

  14. –CVE-2015-1127EPSS 0.4%

    The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entrie…

  15. –CVE-2015-1116EPSS 0.4%

    The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher, which makes it easier for physically proximate attackers to obtain sensitive information by reading the device screen.

  16. –CVE-2015-1114EPSS 0.4%

    The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app.

  17. –CVE-2015-1113EPSS 0.4%

    The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app.

  18. –CVE-2015-1112EPSS 1.5%

    Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, as used on iOS before 8.3 and other platforms, does not properly delete browsing-history data from the history.plist file, which allows attackers to obtain sensitive inform…

  19. –CVE-2015-1111EPSS 1.5%

    Safari in Apple iOS before 8.3 does not delete Recently Closed Tabs data in response to a history-clearing action, which allows attackers to obtain sensitive information by reading a history file.

  20. –CVE-2015-1110EPSS 2.1%

    The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data.

  21. –CVE-2015-1109EPSS 0.4%

    NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by reading a log file.

  22. –CVE-2015-1108EPSS 0.4%

    The Lock Screen component in Apple iOS before 8.3 does not properly enforce the limit on incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses.

  23. –CVE-2015-1106EPSS 0.4%

    The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard.

  24. –CVE-2015-1097EPSS 0.4%

    IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.

  25. –CVE-2015-1096EPSS 0.3%

    IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.

  26. –CVE-2015-1094EPSS 0.3%

    IOAcceleratorFamily in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.

  27. –CVE-2015-1091EPSS 1.6%

    The CFNetwork Session component in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle request headers during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy…

  28. –CVE-2015-1090EPSS 1.5%

    CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading a history file.

  29. –CVE-2015-1089EPSS 1.8%

    CFNetwork in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle cookies during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

  30. –CVE-2015-3030EPSS 0.9%

    The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configuration information via unspecified vectors.

  31. –CVE-2015-1602EPSS 0.4%

    Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords …

  32. –CVE-2015-1890EPSS 1.0%

    /usr/lpp/mmfs/bin/gpfs.snap in IBM General Parallel File System (GPFS) 4.1 before 4.1.0.7 produces an archive potentially containing cleartext keys, and lacks a warning about reviewing this archive to detect included keys, which might allo…

  33. –CVE-2015-0777EPSS 0.4%

    drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive infor…

  34. –CVE-2015-0992EPSS 0.3%

    Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.

  35. –CVE-2015-0991EPSS 1.3%

    Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.

  36. –CVE-2015-0902EPSS 3.0%

    The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by rea…

  37. –CVE-2015-0683EPSS 1.3%

    Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to obtain sensitive information via a file-inclusion attack, aka Bug ID CSCup94744.

  38. –CVE-2014-5405EPSS 2.3%

    Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.

  39. –CVE-2014-5400EPSS 0.3%

    The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to obtain sensitive information by reading a file.

  40. –CVE-2015-2817EPSS 2.4%

    The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.

  41. –CVE-2015-0800EPSS 1.7%

    The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS …

  42. –CVE-2015-2809EPSS 3.5%

    The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffi…

  43. –CVE-2015-1892EPSS 2.2%

    The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers…

  44. –CVE-2015-2108EPSS 1.9%

    Unspecified vulnerability in Powershell Operations in HP Operations Orchestration 9.x and 10.x allows remote authenticated users to obtain sensitive information via unknown vectors.

  45. –CVE-2015-0999EPSS 0.4%

    Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive inform…

  46. –CVE-2015-0998EPSS 0.8%

    Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the net…

  47. –CVE-2015-0997EPSS 2.4%

    Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtai…

  48. –CVE-2015-0996EPSS 0.4%

    Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, w…

  49. –CVE-2014-5427EPSS 1.3%

    Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine …

  50. –CVE-2015-0680EPSS 1.3%

    Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID CSCuq44439.