Weakness (CWE)
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes
information to certain actors in accordance with the
developer's security policy, but this information is regarded
as sensitive according to the intended security policies of
other stakeholders such as the product's administrator,
users, or others whose information is being
processed.
How to prevent it (1 mitigation)
-
Requirements, Architecture and Design
When handling information, the developer must
consider whether the information is regarded as sensitive
by different stakeholders, such as users or administrators.
Each stakeholder effectively has its own intended security
policy that the product is expected to uphold.When a developer does not treat that information
as sensitive, this can introduce a vulnerability that
violates the expectations of the product's users.
Source: MITRE CWE-213
7 results · Clear filters · Feed
-
Low 3.5
HCL Connections is vulnerable to information disclosure
An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.
-
Low 3.5
HCL Connections is vulnerable to information disclosure
HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.
-
Low 3.7
IBM Concert Software information disclosure
IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to excessive data exposure, allowing attackers to access sensitive information without proper filtering.
-
Low 3.7
Exposure of Sensitive Information Due to Incompatible Policies in GitLab
An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uplo…
-
Low 1.9
Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC addres…
-
Low 1.9
Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC a…
-
Low 2.2
Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to g…