Use of HTTP Request With Sensitive Query String
CWE-598
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
We track 34 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Implementation: When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.
Latest Use of HTTP Request With Sensitive Query String vulnerabilities
- 8.8 High severity
nginx-ui: Cleartext Storage of Sensitive Information
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret head
- 7.2 High severity
ash_authentication_phoenix: Use of HTTP Request With Sensitive Query String
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successfu
- 9.8 Critical severity
Ebyte NA111-M Firmware: Use of HTTP Request With Sensitive Query String
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker wit
- 7.5 High severity
grav-plugin-api: Use of HTTP Request With Sensitive Query String
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, i
- 9.8 Critical severity
openssl_encrypt: Use of HTTP Request With Sensitive Query String
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
- 7.4 High severity
HUMANIST Digital Human Resources: Use of HTTP Request With Sensitive Query String
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
- 7.5 High severity
Engineering AI Hub: Use of HTTP Request With Sensitive Query String
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.
- 7.5 High severity
SEPPmail Secure Email Gateway & SEPPmail Cloud: Use of HTTP Request With Sensitive Query String
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.
- 7.5 High severity
grav: Use of HTTP Request With Sensitive Query String
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim
- 8.1 High severity
frigate: Improper Privilege Management
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials
- 7.5 High severity
grav: Use of HTTP Request With Sensitive Query String
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. At
- 7.5 High severity
portainer: Use of HTTP Request With Sensitive Query String
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's authentication middle
- 7.5 High severity
V2board: Use of HTTP Request With Sensitive Query String
Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy
- 7.5 High severity
Apache OpenMeetings: Use of HTTP Request With Sensitive Query String
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affect
- 7.5 High severity
nhost: Exposure of Sensitive Information to an Unauthorized Actor
Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, serv
- 7.5 High severity
immich: Use of HTTP Request With Sensitive Query String
immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application
- 7.5 High severity
Aspera Orchestrator: Use of HTTP Request With Sensitive Query String
IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
- 7.5 High severity
UBR-01 Mk II: Use of HTTP Request With Sensitive Query String
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.
- 7.1 High severity
Global Facilities Management Software: Use of HTTP Request With Sensitive Query String
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.
- 9.1 Critical severity
tugtainer: Use of HTTP Request With Sensitive Query String
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in
- 7.5 High severity
Incoming Goods Suite: Use of HTTP Request With Sensitive Query String
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.
- 9.8 Critical severity
DX NetOps Spectrum: Use of HTTP Request With Sensitive Query String
Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue affects DX NetOps Spectrum: 24.3.8 and earlier.
- 7.5 High severity
Baggage Analytics: Use of HTTP Request With Sensitive Query String
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data
- 8.2 High severity
Directadmin: Use of HTTP Request With Sensitive Query String
An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafted GET request.
- 8.8 High severity
audiobookshelf: Unprotected Transport of Credentials
Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to stor
- 7.5 High severity
Niagara Framework: Use of HTTP Request With Sensitive Query String
Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2
- 7.5 High severity
weblate: Use of HTTP Request With Sensitive Query String
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation proce
- 7.5 High severity
Configured Commerce: Use of HTTP Request With Sensitive Query String
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be
- 7.5 High severity
Checkmk: Use of HTTP Request With Sensitive Query String
Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.
- 7.5 High severity
anybus_x-gateway_ab7832-f3: Use of HTTP Request With Sensitive Query String
An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway (or at least most of its modules). An attacker can us
- 8.2 High severity
dectalk-tts: Channel Accessible by Non-Endpoint
dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `[email protected]`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone
- 7.5 High severity
Maximo Application Suite: Use of HTTP Request With Sensitive Query String
IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser
- 7.5 High severity
FortiOS: Use of HTTP Request With Sensitive Query String
A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET req
- 8.8 High severity
AppSync: Session Fixation
DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session.