CWEweakness
CWE-201 Insertion of Sensitive Information Into Sent Data
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Common consequences
• Confidentiality: Read Files or Directories, Read Memory, Read Application Data — Sensitive data may be exposed to attackers.
Potential mitigations
• [Requirements] Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
• [Implementation] Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.
• [System Configuration] Setup default error messages so that unexpected errors do not disclose sensitive information.
• [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2023-27265: collaboration platform does not honor a "show email address" setting for a response by an API endpoint
• CVE-2023-32275: RPC server for a VPN product returns an object that contains heap addresses
• CVE-2022-0708: Collaboration platform does not clear team emails in a response, allowing leak of email addresses
Related
Attack pattern · CAPEC (9)
- CAPEC-12 Choosing Message Identifier attack pattern
- CAPEC-217 Exploiting Incorrectly Configured SSL/TLS attack pattern
- CAPEC-612 WiFi MAC Address Tracking attack pattern
- CAPEC-613 WiFi SSID Tracking attack pattern
- CAPEC-618 Cellular Broadcast Message Request attack pattern
- CAPEC-619 Signal Strength Tracking attack pattern
- CAPEC-621 Analysis of Packet Timing and Sizes attack pattern
- CAPEC-622 Electromagnetic Side-Channel Attack attack pattern
- CAPEC-623 Compromising Emanations Attack attack pattern
Observed example · CVE (3)
- CVE-2023-32275 An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. vulnerability
- CVE-2023-27265 Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an… vulnerability
- CVE-2022-0708 Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated… vulnerability
Can also be · CWE (2)
Child of · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
Referenced by CAPEC · weakness (9)
- CAPEC-12 Choosing Message Identifier attack pattern
- CAPEC-217 Exploiting Incorrectly Configured SSL/TLS attack pattern
- CAPEC-612 WiFi MAC Address Tracking attack pattern
- CAPEC-613 WiFi SSID Tracking attack pattern
- CAPEC-618 Cellular Broadcast Message Request attack pattern
- CAPEC-619 Signal Strength Tracking attack pattern
- CAPEC-621 Analysis of Packet Timing and Sizes attack pattern
- CAPEC-622 Electromagnetic Side-Channel Attack attack pattern
- CAPEC-623 Compromising Emanations Attack attack pattern
Referenced by CVE · weakness (478)
- CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. vulnerability
- CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. vulnerability
- CVE-2026-48200 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows… vulnerability
- CVE-2026-115591 Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows… vulnerability
- CVE-2026-116689 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. vulnerability
- CVE-2026-115594 Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows… vulnerability
- CVE-2026-114190 Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows… vulnerability
- CVE-2026-53920 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. vulnerability
- CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1… vulnerability
- CVE-2026-114485 Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an… vulnerability
- CVE-2026-113459 In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can… vulnerability
- CVE-2026-19541 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client… vulnerability
- CVE-2026-19601 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind… vulnerability
- CVE-2026-19603 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field… vulnerability
- CVE-2026-109695 Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive… vulnerability
- CVE-2026-110361 Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded… vulnerability
- CVE-2026-75559 The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included… vulnerability
- CVE-2026-108489 Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce… vulnerability
- CVE-2026-52394 DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. vulnerability
- CVE-2026-66822 Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. vulnerability
- CVE-2026-89203 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). vulnerability
- CVE-2023-25996 Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. vulnerability
- CVE-2026-107761 Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. vulnerability
- CVE-2026-42419 Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. vulnerability
- CVE-2026-42630 Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. vulnerability
- CVE-2026-62043 Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. vulnerability
- CVE-2026-66435 Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive… vulnerability
- CVE-2026-105877 Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded… vulnerability
- CVE-2026-87109 An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing… vulnerability
- CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left… vulnerability