Skip to content
OpenAdvisories

Weakness (CWE)

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Base Incomplete

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

How to prevent it (1 mitigation)

  1. Architecture and Design, Implementation

    Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs

Source: MITRE CWE-497

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2023-0342 Public exploit

    MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive

    MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12

    MongoDB MongoDB Ops Manager