Weakness (CWE)
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes
information to certain actors in accordance with the
developer's security policy, but this information is regarded
as sensitive according to the intended security policies of
other stakeholders such as the product's administrator,
users, or others whose information is being
processed.
How to prevent it (1 mitigation)
-
Requirements, Architecture and Design
When handling information, the developer must
consider whether the information is regarded as sensitive
by different stakeholders, such as users or administrators.
Each stakeholder effectively has its own intended security
policy that the product is expected to uphold.When a developer does not treat that information
as sensitive, this can introduce a vulnerability that
violates the expectations of the product's users.
Source: MITRE CWE-213
0 results · Clear filters · Feed