VariantIncomplete

CWE-541Inclusion of Sensitive Information in an Include File

Category: data-exposure

Description

If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.

Common consequences· 1

  • Confidentiality — Read Application Data

Potential mitigations· 2

  • [Architecture and Design]Do not store sensitive information in include files.
  • [Architecture and Design, System Configuration]Protect include files from being exposed.

References

  1. https://cwe.mitre.org/data/definitions/541.html

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CWE
Inclusion of Sensitive Information in Source Code
CWE
Inclusion of Sensitive Information in Test Code
CWE
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CWE
Inclusion of Sensitive Information in Source Code Comments
CWE
Unparsed Raw Web Content Delivery
CWE
Insertion of Sensitive Information Into Sent Data
Sourced from MITRE CWE 4.20. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.