CWE-598
Use of HTTP Request With Sensitive Query String
AI Translation Available
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Status
draft
Abstraction
variant
Affected Platforms
Web Based
Web Server
Technical Details
AI Translation
Common Consequences
confidentiality
Impacts
read application data
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
When sending sensitive information, only
include it in the request body or request headers
instead of the query string. This may require avoiding
use of GET requests.