CWE-202

Exposure of Sensitive Information Through Data Queries
AI Translation Available

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Status
draft
Abstraction
base
Likelihood
medium

In situations where data should not be tied to individual users, but a large number of users should be able to make queries that 'scrub' the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.

Common Consequences

confidentiality
Impacts
read files or directories read application data

Potential Mitigations

Phases:
architecture and design
Descriptions:
• This is a complex topic. See the [REF-1492] for a good discussion of best practices.