CWE-202Exposure of Sensitive Information Through Data Queries

Description

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Common consequences

• Confidentiality→Read Files or Directories,Read Application Data
  Sensitive information may possibly be leaked through data queries accidentally. In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users,

Potential mitigations

• Architecture and Design
  This is a complex topic. See the [REF-1492] for a good discussion of best practices.

Related CWEs

Recent CVEs classified under this CWE