Exposure of Sensitive Information Due to Incompatible Policies
CWE-213
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
How this weakness is prevented
- Requirements Architecture and Design: When handling information, the developer must consider whether the information is regarded as sensitive by different stakeholders, such as users or administrators. Each stakeholder effectively has its own intended security policy that the product is expected to uphold. When a developer does not treat that information as sensitive, this can introduce a vulnerability that violates the expectations of the product's users.
Latest Exposure of Sensitive Information Due to Incompatible Policies vulnerabilities
- 7.5 High severity
nats-server: Plaintext Storage of a Password
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity sta
- 7.5 High severity
Concert Software: Exposure of Sensitive Information Due to Incompatible Policies
IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to excessive data exposure, allowing attackers to access sensitive information without proper filtering.
- 9.1 Critical severity
GitLab: Exposure of Sensitive Information Due to Incompatible Policies
An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches.
- 7.5 High severity
MİA-MED: Exposure of Sensitive Information Due to Incompatible Policies
Exposure of Sensitive Information Due to Incompatible Policies vulnerability in Mia Technology Inc. MİA-MED allows Collect Data as Provided by Users. This issue affects MİA-MED: before 1.0.7.
- 7.5 High severity
Pdfescape: Exposure of Sensitive Information Due to Incompatible Policies
Avanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vulnerable to Information Leak / Disclosure. The PDFEscape Online tool provides users with a "white out" functionality for redacting images, text, and other graphics from a PDF document. However, this m