CWE-497
AllowedExposure of Sensitive System Information to an Unauthorized Control Sphere
Abstraction: Base · Status: Incomplete
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
741 vulnerabilities reference this CWE, most recent first.
GHSA-96F5-9X27-7HHH
Vulnerability from github – Published: 2026-01-13 15:37 – Updated: 2026-01-15 12:30Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox < 147 and Firefox ESR < 140.7.
{
"affected": [],
"aliases": [
"CVE-2026-0887"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-13T14:16:39Z",
"severity": "MODERATE"
},
"details": "Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox \u003c 147 and Firefox ESR \u003c 140.7.",
"id": "GHSA-96f5-9x27-7hhh",
"modified": "2026-01-15T12:30:26Z",
"published": "2026-01-13T15:37:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0887"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2006500"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-01"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-03"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-04"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9778-HPMV-MX63
Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2026-04-01 18:36Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Social Pug allows Retrieve Embedded Sensitive Data. This issue affects Social Pug: from n/a through 1.35.1.
{
"affected": [],
"aliases": [
"CVE-2025-58007"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-22T19:16:02Z",
"severity": "MODERATE"
},
"details": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Social Pug allows Retrieve Embedded Sensitive Data. This issue affects Social Pug: from n/a through 1.35.1.",
"id": "GHSA-9778-hpmv-mx63",
"modified": "2026-04-01T18:36:13Z",
"published": "2025-09-22T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58007"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/social-pug/vulnerability/wordpress-social-pug-plugin-1-35-1-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-987G-RMGR-MPFX
Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-18 18:31SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.
{
"affected": [],
"aliases": [
"CVE-2026-7864"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T14:16:47Z",
"severity": "MODERATE"
},
"details": "SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.",
"id": "GHSA-987g-rmgr-mpfx",
"modified": "2026-05-18T18:31:24Z",
"published": "2026-05-08T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7864"
},
{
"type": "WEB",
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security"
},
{
"type": "WEB",
"url": "https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-98CV-WQJX-WX8F
Vulnerability from github – Published: 2025-05-13 14:08 – Updated: 2025-05-13 14:08Summary
Users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using sudo --list <pathname>.
PoC
As root:
# mkdir /tmp/foo
# chmod a-rwx /tmp/foo
# touch /tmp/foo/secret_file
As a user without any (or limited) sudo rights:
$ sudo --list /tmp/foo/nonexistent_file
sudo-rs: '/tmp/foo/nonexistent_file': command not found
$ $ sudo --list /tmp/foo/secret_file
sudo-rs: Sorry, user eve may not run sudo on host.
I.e. the user can distinguish whether files exist.
Related
Original sudo (vulnerable version tested by us: 1.9.15p5) exhibited similar behaviour for files with the executable bit set.
Impact
Users with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks.
Credits
This issue was identified by sudo-rs developer Marc Schoolderman
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.2.5"
},
"package": {
"ecosystem": "crates.io",
"name": "sudo-rs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-46717"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-13T14:08:18Z",
"nvd_published_at": "2025-05-12T15:16:01Z",
"severity": "LOW"
},
"details": "### Summary\n\nUsers with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list \u003cpathname\u003e`.\n\n### PoC\n\nAs root:\n```\n# mkdir /tmp/foo\n# chmod a-rwx /tmp/foo\n# touch /tmp/foo/secret_file\n```\nAs a user without any (or limited) sudo rights:\n```\n$ sudo --list /tmp/foo/nonexistent_file\nsudo-rs: \u0027/tmp/foo/nonexistent_file\u0027: command not found\n$ $ sudo --list /tmp/foo/secret_file\nsudo-rs: Sorry, user eve may not run sudo on host.\n```\nI.e. the user can distinguish whether files exist.\n\n### Related\nOriginal sudo (vulnerable version tested by us: 1.9.15p5) exhibited similar behaviour for files with the executable bit set.\n\n### Impact\nUsers with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks.\n\n### Credits\nThis issue was identified by sudo-rs developer Marc Schoolderman",
"id": "GHSA-98cv-wqjx-wx8f",
"modified": "2025-05-13T14:08:18Z",
"published": "2025-05-13T14:08:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-98cv-wqjx-wx8f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46717"
},
{
"type": "PACKAGE",
"url": "https://github.com/trifectatechfoundation/sudo-rs"
},
{
"type": "WEB",
"url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders"
}
GHSA-997Q-PJFP-RVGG
Vulnerability from github – Published: 2026-03-03 21:31 – Updated: 2026-03-03 21:31IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system.
{
"affected": [],
"aliases": [
"CVE-2025-13616"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-03T20:16:42Z",
"severity": "MODERATE"
},
"details": "IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system.",
"id": "GHSA-997q-pjfp-rvgg",
"modified": "2026-03-03T21:31:15Z",
"published": "2026-03-03T21:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13616"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7261771"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9CP8-FXMH-4HC3
Vulnerability from github – Published: 2026-06-26 15:32 – Updated: 2026-06-26 15:32Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versions.
{
"affected": [],
"aliases": [
"CVE-2026-57633"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T15:16:50Z",
"severity": "MODERATE"
},
"details": "Unauthenticated Sensitive Data Exposure in WCBoost \u0026#8211; Products Compare \u003c= 1.1.0 versions.",
"id": "GHSA-9cp8-fxmh-4hc3",
"modified": "2026-06-26T15:32:17Z",
"published": "2026-06-26T15:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57633"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wcboost-products-compare/vulnerability/wordpress-wcboost-8211-products-compare-plugin-1-1-0-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9FMX-H3QH-94WC
Vulnerability from github – Published: 2025-04-07 12:33 – Updated: 2025-04-07 12:33Information disclosure while creating MQ channels.
{
"affected": [],
"aliases": [
"CVE-2024-45549"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-07T11:15:49Z",
"severity": "HIGH"
},
"details": "Information disclosure while creating MQ channels.",
"id": "GHSA-9fmx-h3qh-94wc",
"modified": "2025-04-07T12:33:18Z",
"published": "2025-04-07T12:33:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45549"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9G2X-9V62-M8G9
Vulnerability from github – Published: 2026-01-28 21:31 – Updated: 2026-01-28 21:31A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.
{
"affected": [],
"aliases": [
"CVE-2023-37525"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-28T20:16:06Z",
"severity": "MODERATE"
},
"details": "A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.",
"id": "GHSA-9g2x-9v62-m8g9",
"modified": "2026-01-28T21:31:23Z",
"published": "2026-01-28T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37525"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128385"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9G58-R8R8-66HP
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04A vulnerability in logging mechanisms of Cisco Webex Meetings client software could allow an authenticated, local attacker to gain access to sensitive information. This vulnerability is due to unsafe logging of application actions. An attacker could exploit this vulnerability by logging onto the local system and accessing files containing the logged details. A successful exploit could allow the attacker to gain access to sensitive information, including meeting data and recorded meeting transcriptions.
{
"affected": [],
"aliases": [
"CVE-2021-1544"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-04T17:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in logging mechanisms of Cisco Webex Meetings client software could allow an authenticated, local attacker to gain access to sensitive information. This vulnerability is due to unsafe logging of application actions. An attacker could exploit this vulnerability by logging onto the local system and accessing files containing the logged details. A successful exploit could allow the attacker to gain access to sensitive information, including meeting data and recorded meeting transcriptions.",
"id": "GHSA-9g58-r8r8-66hp",
"modified": "2022-05-24T19:04:04Z",
"published": "2022-05-24T19:04:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1544"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-8fpBnKOz"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9H48-FM9C-H5C2
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2026-01-20 15:32Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensitive Data.This issue affects Image Cleanup: from n/a through <= 1.9.2.
{
"affected": [],
"aliases": [
"CVE-2025-62737"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:18:02Z",
"severity": "MODERATE"
},
"details": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensitive Data.This issue affects Image Cleanup: from n/a through \u003c= 1.9.2.",
"id": "GHSA-9h48-fm9c-h5c2",
"modified": "2026-01-20T15:32:02Z",
"published": "2025-12-09T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62737"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/image-cleanup/vulnerability/wordpress-image-cleanup-plugin-1-9-2-sensitive-data-exposure-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/image-cleanup/vulnerability/wordpress-image-cleanup-plugin-1-9-2-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs
CAPEC-170: Web Application Fingerprinting
An attacker sends a series of probes to a web application in order to elicit version-dependent and type-dependent behavior that assists in identifying the target. An attacker could learn information such as software versions, error pages, and response headers, variations in implementations of the HTTP protocol, directory structures, and other similar information about the targeted service. This information can then be used by an attacker to formulate a targeted attack plan. While web application fingerprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
CAPEC-694: System Location Discovery
An adversary collects information about the target system in an attempt to identify the system's geographical location.
Information gathered could include keyboard layout, system language, and timezone. This information may benefit an adversary in confirming the desired target and/or tailoring further attacks.