Weakness (CWE)
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
More detail
Resources that may contain sensitive data include documents, packets, messages, databases, etc. While this data may be useful to an individual user or small set of users who share the resource, it may need to be removed before the resource can be shared outside of the trusted group. The process of removal is sometimes called cleansing or scrubbing.
For example, a product for editing documents might not remove sensitive data such as reviewer comments or the local pathname where the document is stored. Or, a proxy might not remove an internal IP address from headers before making an outgoing request to an Internet site.
How to prevent it (5 mitigations)
-
Requirements
Clearly specify which information should be regarded as private or sensitive, and require that the product offers functionality that allows the user to cleanse the sensitive information from the resource before it is published or exported to other parties.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
-
Implementation, Operation
Some tools can automatically analyze
documents to redact, strip, or "sanitize" private
information, although some human review might be
necessary. Tools may vary in terms of which document
formats can be processed.When calling an external program to automatically
generate or convert documents, invoke the program with
any available options that avoid generating sensitive
metadata. Some formats have well-defined fields that
could contain private data, such as Exchangeable image
file format (Exif), which can contain potentially
sensitive metadata such as geolocation, date, and time
[REF-1515] [REF-1516]. -
Implementation
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
-
Implementation
Avoid errors related to improper resource shutdown or release (CWE-404), which may leave the sensitive data within the resource if it is in an incomplete state.
Source: MITRE CWE-212
109 results · Feed
-
High 8.2
Protected fields exposed via LiveQuery in parse-server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes pr…
-
High 7.7
CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a reque…
-
High 7.5
Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a …
-
Medium 4.6
Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.
-
High 7.5
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permis…
-
High 8.8
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authen…
-
Medium 4.6
Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SS…
-
Medium 6.8
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel…
-
High 8.1
Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
-
High 7.5
Insufficient password hash filtering in some IRRd queries and exports
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries…
-
Medium 5.5
Buildah processes using chroot isolation may leak environment values to intermediate processes
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a co…
-
Low 2.6
Unauthorized forwarding of confidential headers in fluture-node
Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential hea…
-
Medium 6.5
Jenkins Support Core Plugin stores sensitive data in plain text
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
-
High 7.4
Exposure of sensitive information in Action Pack
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local stat…
-
Low 2.6
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
-
Medium 4.4
Expired Ephemeral Messages not reliably removed in wire-webapp
Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production.0 ephemeral message…
-
High 8.8
Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-get
Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.
-
Medium 5.3
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
-
Unscored —
An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access netw…
-
Medium 5.0
Ansible does not collect garbage after playbook run
A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.
-
Medium 5.3
Information disclosure in podman
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from th…
-
High 8.0
RCE in Symfony
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cac…
-
High 7.5
Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak
The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribut…
-
Low 3.1
Kubernetes did not effectively clear service account credentials
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClie…
-
High 7.5
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in …
-
Low 3.4
In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connect…
-
High 7.2
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Onl…
-
Unscored —
A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Dele…
-
Medium 6.5
Openstack nova: information leak in libvirt lvm-backed instances
OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading t…