CWE-598βUse of HTTP Request With Sensitive Query String
PUBLISHEDweakness record
released 2006-12-15 Β· last modified 2026-04-30
Metadata
- CWE ID:
- CWE-598
- Abstraction:
- Variant
- Structure:
- Simple
- Status:
- Draft
- Release Date:
- 2006-12-15
- Latest Modification Date:
- 2026-04-30
Weakness Name
Use of HTTP Request With Sensitive Query String
Description
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Common Consequences
- Scope:
- Confidentiality
- Impact:
- Read Application Data
- Notes:
- At a minimum, attackers can garner information from query strings that can be utilized in escalating their method of attack, such as information about the internal workings of the application or database column names. Successful exploitation of query string parameter vulnerabilities could lead to an attacker impersonating a legitimate user, obtaining proprietary data, or simply executing actions not intended by the application developers. Examples of sensitive information may include secrets such as session identifiers, passwords, access tokens, or API keys; Personally Identifiable Information (PII) such as email addresses or phone numbers; records or logs of private activities; communications that are expected to be private; etc. Successful exploitation of query string parameter vulnerabilities could lead to an attacker impersonating a legitimate user, obtaining proprietary data, or simply executing actions not intended by the application developers.
