CWE-540Inclusion of Sensitive Information in Source Code

Description

The product (such as a web server or repository) provides access to source code is not intended to be accessible to users but contains sensitive information.

Common consequences

• Confidentiality→Read Application Data,Varies by Context
  Obtaining source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.

Potential mitigations

• Architecture and Design,System Configuration
  Recommendations include removing the script from the web server and moving it to a location not accessible from the Internet.

Related CWEs

Recent CVEs classified under this CWE