CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Description

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Submission Date :

July 19, 2006, midnight

Modification Date :

2023-10-26 00:00:00+00:00

Organization :

MITRE
Example Vulnerable Codes

Example - 1

In the following code snippet, a user's full name and credit card number are written to a log file.

logger.info("Username: " + usernme + ", CCN: " + ccn);

Related Weaknesses

This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Go to
CWE-532: Insertion of Sensitive Information into Log File
Go to
CWE-540: Inclusion of Sensitive Information in Source Code
Go to
CWE-651: Exposure of WSDL File Containing Sensitive Information
Go to

Visit http://cwe.mitre.org/ for more details.