CWE-200

ClassDraft

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

2,542 linked vulnerabilities

1 related weaknesses

Architecture and Design

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide...

ConfidentialityRead Application Data

Automated Static Analysis - Binary or BytecodeEffectiveness: SOAR Partial

According to SOAR [REF-1479], the following detection techniques may be useful:

Bytecode Weakness Analysis - including disassembler + source code weakness analysis
Inter-application Flow Analysis

Dynamic Analysis with Automated Results InterpretationEffectiveness: High

According to SOAR [REF-1479], the following detection techniques may be useful:

Web Application Scanner
Web Services Scanner
Database Scanners

Dynamic Analysis with Manual Results InterpretationEffectiveness: SOAR Partial

According to SOAR [REF-1479], the following detection techniques may be useful:

Fuzz Tester
Framework-based Fuzzer
Automated Monitored Execution
Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious

Manual Static Analysis - Source CodeEffectiveness: High

According to SOAR [REF-1479], the following detection techniques may be useful: