CWE-598Use of HTTP Request With Sensitive Query String

Description

The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Common consequences

• Confidentiality→Read Application Data
  [object Object]

Potential mitigations

• Implementation
  When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.

Related CWEs

Recent CVEs classified under this CWE