CWE-532Insertion of Sensitive Information into Log File

Description

The product writes sensitive information to a log file.

Common consequences

• Confidentiality→Read Application Data
  Logging sensitive user data, full path names, or system information often provides attackers with an additional, less-protected path to acquiring the information.

Potential mitigations

• Architecture and Design,Implementation
  Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
• Distribution
  Remove debug log files before deploying the application into production.
• Operation
  Protect log files against unauthorized read/write.
• Implementation
  Adjust configurations appropriately when software is transitioned from a debug state to production.

Related CWEs

Recent CVEs classified under this CWE