Skip to content
OpenAdvisories

Weakness (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Class Draft Mapping discouraged

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-200

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.6
    CVE-2024-24919 Exploited · Ransomware Public exploit EPSS 100%

    Information disclosure

    Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

    checkpoint Check Point Quantum Gateway, Spark Gateway and CloudGuard Network Network devices
    KEV May 30, 2024
  • High 7.5
    CVE-2023-28432 Exploited Public exploit EPSS 84%

    Minio Information Disclosure in Cluster Deployment

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, res…

    minio minio
    KEV Apr 21, 2023
  • High 7.5
    CVE-2022-36537 Exploited · Ransomware Public exploit EPSS 95%

    ZK Framework vulnerable to malicious POST

    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

    org.zkoss.zk:zk Maven
    KEV Feb 27, 2023
  • High 7.7
    CVE-2018-5430 Exploited Public exploit EPSS 48%

    TIBCO JasperReports Server Information Disclosure Vulnerability

    The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics …

    TIBCO Software TIBCO JasperReports Server TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server - Community Edition Ubuntu
    KEV Dec 29, 2022
  • High 7.5
    CVE-2016-6415 Exploited Public exploit EPSS 88%

    The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.…

    KEV May 19, 2023