cve.bz

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, page 82

Filter

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

What the weakness is: CWE-200 at MITRE

Related attack patterns (CAPEC): 59
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-59 Session Credential Falsification through Prediction Likelihood: High · Severity: High
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-116 Excavation Likelihood: High · Severity: Medium
  • CAPEC-169 Footprinting Likelihood: High · Severity: Very Low
  • CAPEC-224 Fingerprinting Likelihood: High · Severity: Very Low
  • CAPEC-285 ICMP Echo Request Ping Likelihood: Medium · Severity: Low
  • CAPEC-287 TCP SYN Scan Severity: Low
  • CAPEC-290 Enumerate Mail Exchange (MX) Records Severity: Low
  • CAPEC-291 DNS Zone Transfers Severity: Low
  • CAPEC-292 Host Discovery Severity: Low
  • CAPEC-293 Traceroute Route Enumeration Severity: Low
  • CAPEC-294 ICMP Address Mask Request Severity: Low
  • CAPEC-295 Timestamp Request Severity: Low
  • CAPEC-296 ICMP Information Request Severity: Low
  • CAPEC-297 TCP ACK Ping Severity: Low
  • CAPEC-298 UDP Ping Severity: Low
  • CAPEC-299 TCP SYN Ping Severity: Low
  • CAPEC-300 Port Scanning Severity: Low
  • CAPEC-301 TCP Connect Scan Severity: Low
  • CAPEC-302 TCP FIN Scan Severity: Low
  • CAPEC-303 TCP Xmas Scan Severity: Low
  • CAPEC-304 TCP Null Scan Severity: Low
  • CAPEC-305 TCP ACK Scan Severity: Low
  • CAPEC-306 TCP Window Scan Severity: Low
  • CAPEC-307 TCP RPC Scan Severity: Low
  • CAPEC-308 UDP Scan Severity: Low
  • CAPEC-309 Network Topology Mapping Severity: Low
  • CAPEC-310 Scanning for Vulnerable Software Severity: Low
  • CAPEC-312 Active OS Fingerprinting Likelihood: Medium · Severity: Low
  • CAPEC-313 Passive OS Fingerprinting Likelihood: High · Severity: Low
  • CAPEC-317 IP ID Sequencing Probe Likelihood: Medium · Severity: Low
  • CAPEC-318 IP 'ID' Echoed Byte-Order Probe Likelihood: Medium · Severity: Low
  • CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe Likelihood: Medium · Severity: Low
  • CAPEC-320 TCP Timestamp Probe Likelihood: Medium · Severity: Low
  • CAPEC-321 TCP Sequence Number Probe Likelihood: Medium · Severity: Low
  • CAPEC-322 TCP (ISN) Greatest Common Divisor Probe Likelihood: Medium · Severity: Low
  • CAPEC-323 TCP (ISN) Counter Rate Probe Likelihood: Medium · Severity: Low
  • CAPEC-324 TCP (ISN) Sequence Predictability Probe Likelihood: Medium · Severity: Low
  • CAPEC-325 TCP Congestion Control Flag (ECN) Probe Likelihood: Medium · Severity: Low
  • CAPEC-326 TCP Initial Window Size Probe Likelihood: Medium · Severity: Low
  • CAPEC-327 TCP Options Probe Likelihood: Medium · Severity: Low
  • CAPEC-328 TCP 'RST' Flag Checksum Probe Likelihood: Medium · Severity: Low
  • CAPEC-329 ICMP Error Message Quoting Probe Likelihood: Medium · Severity: Low
  • CAPEC-330 ICMP Error Message Echoing Integrity Probe Likelihood: Medium · Severity: Low
  • CAPEC-472 Browser Fingerprinting Severity: Low
  • CAPEC-497 File Discovery Likelihood: High · Severity: Very Low
  • CAPEC-508 Shoulder Surfing Likelihood: High · Severity: High
  • CAPEC-573 Process Footprinting Likelihood: Low · Severity: Low
  • CAPEC-574 Services Footprinting Likelihood: Low · Severity: Low
  • CAPEC-575 Account Footprinting Likelihood: Low · Severity: Low
  • CAPEC-576 Group Permission Footprinting Likelihood: Low · Severity: Low
  • CAPEC-577 Owner Footprinting Likelihood: Low · Severity: Low
  • CAPEC-616 Establish Rogue Location Likelihood: Medium · Severity: Medium
  • CAPEC-643 Identify Shared Files/Directories on System Likelihood: Medium · Severity: Medium
  • CAPEC-646 Peripheral Footprinting Likelihood: Low · Severity: Medium
  • CAPEC-651 Eavesdropping Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-200, as MITRE names them. Credits.

Ask an AI about CWE-200

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/200.html and https://cve.bz/cve/cwe/200?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2023-6727EPSS 0.4%

    Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on s…

  2. 5.3CVE-2023-46701EPSS 0.4%

    Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an attacker to get limited information about a post if they know the post ID

  3. 5.5CVE-2023-42884EPSS 0.4%

    This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13.6.3, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. An app may be able to disclose ke…

  4. 5.3CVE-2023-6615EPSS 0.7%

    A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/manage-users.php. The manipulation of the argument page leads to information dis…

  5. 5.3CVE-2023-6393EPSS 0.6%

    A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request co…

  6. 5.3CVE-2023-6459EPSS 0.5%

    Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

  7. 5.3CVE-2023-49283EPSS 2.2%

    microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the f…

  8. 5.3CVE-2023-49282EPSS 2.2%

    msgraph-sdk-php is the Microsoft Graph Library for PHP. The Microsoft Graph PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at …

  9. 4.8CVE-2023-49292EPSS 0.3%

    ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerab…

  10. 6.5CVE-2023-37868EPSS 0.7%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.

  11. 5.3CVE-2023-36523EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.

  12. 5.3CVE-2023-36507EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar P…

  13. 6.5CVE-2023-26533EPSS 0.7%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1.

  14. 5.3CVE-2023-25057EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2.

  15. 6.5CVE-2023-48333EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1.

  16. 5.3CVE-2023-46820EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Select Crop: from n/a through 7.3.0.

  17. 5.3CVE-2023-45834EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.4.4.

  18. 7.5CVE-2023-45066EPSS 0.5%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.

  19. 7.5CVE-2023-44150EPSS 0.8%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Pa…

  20. 7.5CVE-2023-41735EPSS 0.7%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.

  21. 7.5CVE-2023-40662EPSS 0.7%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.

  22. 7.5CVE-2023-40600ExploitEPSS 2.0%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.

  23. 7.5CVE-2023-40211ExploitEPSS 2.2%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.

  24. 7.5CVE-2023-37972EPSS 0.7%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Product Stock Manager & Notifier for WooCommerce: from n/a through 2.0.1.

  25. 7.5CVE-2023-6136EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.

  26. 4.3CVE-2023-42505EPSS 1.0%

    An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.

  27. 7.5CVE-2023-49068EPSS 1.1%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the…

  28. 4.3CVE-2023-45223EPSS 0.5%

    Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled.

  29. 4.3CVE-2023-43754EPSS 0.5%

    Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archive…

  30. 7.5CVE-2023-48796EPSS 1.2%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the f…

  31. 4.9CVE-2021-39008EPSS 0.6%

    IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a privileged user to obtain sensitive information due to missing best practices. IBM X-Force ID: 213551.

  32. 7.5CVE-2023-47529EPSS 1.0%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.

  33. 7.5CVE-2023-47244EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.

  34. 6.5CVE-2023-41786EPSS 0.5%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 70…

  35. 5.5CVE-2023-43123EPSS 0.4%

    On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not im…

  36. 7.5CVE-2023-47668EPSS 1.0%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

  37. 6.5CVE-2023-40002EPSS 0.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.

  38. 6.5CVE-2023-23978EPSS 0.7%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.

  39. 5.3CVE-2023-6264EPSS 0.5%

    Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints.

  40. 6.5CVE-2022-36777EPSS 0.6%

    IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the s…

  41. 6.5CVE-2023-2446EPSS 0.8%

    The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called…

  42. 5.3CVE-2023-47393EPSS 0.5%

    An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user information via unspecified vectors.

  43. 5.3CVE-2023-47392EPSS 0.5%

    An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request.

  44. 4.3CVE-2021-22143EPSS 0.7%

    The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM serve…

  45. 9.8CVE-2023-6248EPSS 1.2%

    The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks…

  46. 7.5CVE-2023-49103KEVExploitEPSS 78%

    An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration d…

  47. 5.3CVE-2023-47643ExploitEPSS 3.0%

    SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacke…

  48. 4.3CVE-2023-48294EPSS 0.7%

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one re…

  49. 4.3CVE-2020-11447EPSS 0.7%

    An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req - this is an information leak because the serial number is intended to prove an actor's physical ac…

  50. 4.3CVE-2023-47642EPSS 0.5%

    Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stream incorrectly continued being able to use the Zulip API to access metadata for …