Description
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Potential Impact
Confidentiality
Read Files or Directories, Read Memory, Read Application Data
Demonstrative Examples
Warning: mysql_pconnect(): Access denied for user: 'root@localhost' (Using password: N1nj4) in /usr/local/www/wi-data/includes/database.inc on line 4Mitigations & Prevention
Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.
Setup default error messages so that unexpected errors do not disclose sensitive information.
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least
Detection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2023-27265 | collaboration platform does not honor a "show email address" setting for a response by an API endpoint |
| CVE-2023-32275 | RPC server for a VPN product returns an object that contains heap addresses |
| CVE-2022-0708 | Collaboration platform does not clear team emails in a response, allowing leak of email addresses |
Related Weaknesses
Taxonomy Mappings
- CLASP: — Accidental leaking of sensitive information through sent data
Frequently Asked Questions
What is CWE-201?
CWE-201 (Insertion of Sensitive Information Into Sent Data) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
How can CWE-201 be exploited?
Attackers can exploit CWE-201 (Insertion of Sensitive Information Into Sent Data) to read files or directories, read memory, read application data. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-201?
Key mitigations include: Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
What is the severity of CWE-201?
CWE-201 is classified as a Base-level weakness (Medium abstraction). It has been observed in 3 real-world CVEs.