BaseIncomplete

CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere

Category: auth

Description

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Common consequences· 1

  • Confidentiality — Read Application Data

Potential mitigations· 1

  • [Architecture and Design, Implementation]Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs

Related CAPEC attack patterns· 2

CAPEC-170CAPEC-694

References

  1. https://cwe.mitre.org/data/definitions/497.html

Exploits (incoming)2

TypeTargetConfidenceTier
AttackPatternWeb Application Fingerprintingcapec-170100%live
AttackPatternSystem Location Discoverycapec-694100%live

(incoming)16

TypeTargetConfidenceTier
VulnerabilityCVE-2025-0061cve-2025-00610%live
VulnerabilityCVE-2025-10264cve-2025-102640%live
VulnerabilityCVE-2025-11151cve-2025-111510%live
VulnerabilityCVE-2025-1144cve-2025-11440%live
VulnerabilityCVE-2025-12779cve-2025-127790%live
VulnerabilityCVE-2025-44823cve-2025-448230%live
VulnerabilityCVE-2025-47699cve-2025-476990%live
VulnerabilityCVE-2025-5893cve-2025-58930%live
VulnerabilityCVE-2025-6561cve-2025-65610%live
VulnerabilityCVE-2025-9364cve-2025-93640%live
VulnerabilityCVE-2025-9986cve-2025-99860%live
VulnerabilityCVE-2026-24222cve-2026-242220%live
VulnerabilityCVE-2026-27494cve-2026-274940%live
VulnerabilityCVE-2026-34413cve-2026-344130%live
VulnerabilityCVE-2026-42047cve-2026-420470%live
KEVEntryMicrosoft Windows Kernel Information Disclosure Vulnerabilitykev-cve-2021-319550%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CWE
Exposure of Sensitive Information to an Unauthorized Actor
CWE
Improper Access Control
CWE
Exposure of Resource to Wrong Sphere
CWE
Exposure of Sensitive Information Through Metadata
CWE
Insufficiently Protected Credentials
CWE
Exposure of Sensitive Information Due to Incompatible Policies
Sourced from MITRE CWE 4.20. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.