CWE-202

Base Abstraction Level
Pillar — Highest-level weakness category
Class — Abstract, language-independent
Base — Specific enough to detect
Variant — Tied to specific technology
Compound — Requires multiple weaknesses Draft MITRE CWE Status
Stable — Fully reviewed and complete
Draft — Under development, may change
Incomplete — Partially defined by MITRE
Deprecated — No longer recommended
Obsolete — Replaced by another CWE Exploit: Medium
Exposure of Sensitive Information Through Data Queries

Description

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.

Consequences

Confidentiality — Read Files or Directories, Read Application Data

Sensitive information may possibly be leaked through data queries accidentally.

Mitigations

Phase: Architecture and Design

This is a complex topic. See the [REF-1492] for a good discussion of best practices.