CWEweakness
CWE-402 Transmission of Private Resources into a New Sphere
- Alternate terms
- Resource Leak
- Abstraction
- Class
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
Common consequences
• Confidentiality: Read Application Data
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2003-0740: Server leaks a privileged file descriptor, allowing the server to be hijacked.
• CVE-2004-1033: File descriptor leak allows read of restricted files.
Related
Observed example · CVE (2)
- CVE-2004-1033 Fcron 2.0.1, 2.9.4, and possibly earlier versions leak file descriptors of open files, which allows local users to bypass access… vulnerability
- CVE-2003-0740 Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel… vulnerability
Child of · CWE (1)
- CWE-668 Exposure of Resource to Wrong Sphere weakness
Referenced by CVE · weakness (23)
- CVE-2025-67745 MyHoard is a daemon for creating, managing and restoring MySQL backups. vulnerability
- CVE-2024-32388 Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. vulnerability
- CVE-2025-66422 Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. vulnerability
- CVE-2025-55014 The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the… vulnerability
- CVE-2025-49618 In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint. vulnerability
- CVE-2025-52925 In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812. vulnerability
- CVE-2025-48383 Django-Select2 is a Django integration for Select2. vulnerability
- CVE-2025-32360 In Zammad 6.4.x before 6.4.2, there is information exposure. vulnerability
- CVE-2025-29925 XWiki Platform is a generic wiki platform. vulnerability
- CVE-2025-0502 Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64… vulnerability
- CVE-2024-47146 Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically… vulnerability
- CVE-2024-29900 Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready… vulnerability
- CVE-2024-0443 A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. vulnerability
- CVE-2023-38509 XWiki Platform is a generic wiki platform. vulnerability
- CVE-2022-3596 An information leak was found in OpenStack's undercloud. vulnerability
- CVE-2023-4569 A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. vulnerability
- CVE-2023-34467 XWiki Platform is a generic wiki platform. vulnerability
- CVE-2022-30231 A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). vulnerability
- CVE-2021-23263 Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in… vulnerability
- CVE-2021-23264 Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. vulnerability
- CVE-2021-31407 Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through… vulnerability
- CVE-2021-31410 Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access… vulnerability
- CVE-2017-8442 Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive… vulnerability