Weakness (CWE)
CWE-1230: Exposure of Sensitive Information Through Metadata
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
More detail
Developers might correctly prevent unauthorized access to a database or other resource containing sensitive information, but they might not consider that portions of the original information might also be recorded in metadata, search indices, statistical reports, or other resources. If these resources are not also restricted, then attackers might be able to extract some or all of the original information, or otherwise infer some details. For example, an attacker could specify search terms that are known to be unique to a particular person, or view metadata such as activity or creation dates in order to identify usage patterns.
Source: MITRE CWE-1230
7 results · Clear filters · Feed
-
High 7.6
Opto 22 groov View Exposure of Sensitive Information Through Metadata
The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.
-
High 7.3
Session ID leakage in Zone.Identifier of downloaded files
The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloa…
-
High 7.5
Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware
Information disclosure while accessing and modifying the PIB file of a remote device via powerline.
-
High 8.8
Exposure of Private API Keys in lunary-ai/lunary
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensit…
-
High 7.5
Exposure of Sensitive Information in berriai/litellm
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, whic…
-
High 7.5
Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An…
-
High 7.7
Exposure of Sensitive Information Through Metadata in answerdev/answer
Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.