CWE-598—Use of HTTP Request With Sensitive Query String
PUBLISHEDweakness record
released 2006-12-15 · last modified 2026-04-30
Metadata
- CWE ID：
- CWE-598
- 摘要：
- Variant
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2006-12-15
- 更新日期：
- 2026-04-30
名称
Use of HTTP Request With Sensitive Query String
描述
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
常见后果
- 范围：
- Confidentiality
- 影响：
- Read Application Data
- 注释：
- At a minimum, attackers can garner information from query strings that can be utilized in escalating their method of attack, such as information about the internal workings of the application or database column names. Successful exploitation of query string parameter vulnerabilities could lead to an attacker impersonating a legitimate user, obtaining proprietary data, or simply executing actions not intended by the application developers. Examples of sensitive information may include secrets such as session identifiers, passwords, access tokens, or API keys; Personally Identifiable Information (PII) such as email addresses or phone numbers; records or logs of private activities; communications that are expected to be private; etc. Successful exploitation of query string parameter vulnerabilities could lead to an attacker impersonating a legitimate user, obtaining proprietary data, or simply executing actions not intended by the application developers.
