CWEweakness
CWE-1230 Exposure of Sensitive Information Through Metadata
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
Extended description
Developers might correctly prevent unauthorized access to a database or other resource containing sensitive information, but they might not consider that portions of the original information might also be recorded in metadata, search indices, statistical reports, or other resources. If these resources are not also restricted, then attackers might be able to extract some or all of the original information, or otherwise infer some details. For example, an attacker could specify search terms that are known to be unique to a particular person, or view metadata such as activity or creation dates in order to identify usage patterns.
Common consequences
• Confidentiality: Read Application Data
Related
Child of · CWE (1)
- CWE-285 Improper Authorization weakness
Referenced by CVE · weakness (26)
- CVE-2026-14351 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1… vulnerability
- CVE-2025-59601 Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device… vulnerability
- CVE-2026-45544 Nextcloud is an open source content collaboration platform. vulnerability
- CVE-2026-49270 Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. vulnerability
- CVE-2025-31959 HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. vulnerability
- CVE-2026-29055 Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. vulnerability
- CVE-2026-27661 A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). vulnerability
- CVE-2025-13084 The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. vulnerability
- CVE-2025-30038 The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. vulnerability
- CVE-2025-8713 PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. vulnerability
- CVE-2025-47324 Information disclosure while accessing and modifying the PIB file of a remote device via powerline. vulnerability
- CVE-2023-50458 In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs. vulnerability
- CVE-2025-48941 MyBB is free and open source forum software. vulnerability
- CVE-2024-9099 In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with… vulnerability
- CVE-2024-9447 An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. vulnerability
- CVE-2025-0330 In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing… vulnerability
- CVE-2025-1921 Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about… vulnerability
- CVE-2025-26527 Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. vulnerability
- CVE-2024-10324 The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,… vulnerability
- CVE-2024-47517 Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access vulnerability
- CVE-2024-53291 Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. vulnerability
- CVE-2024-49395 In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from… vulnerability
- CVE-2024-8910 The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… vulnerability
- CVE-2023-6962 The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the… vulnerability
- CVE-2023-32488 Dell PowerScale OneFS, 8.2.x-9.5.0.x, contains an information disclosure vulnerability in NFS. vulnerability
- CVE-2023-1974 Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8. vulnerability