CWE-1230
AllowedExposure of Sensitive Information Through Metadata
Abstraction: Base · Status: Incomplete
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
48 vulnerabilities reference this CWE, most recent first.
GHSA-HCVH-MWX3-F4MP
Vulnerability from github – Published: 2024-12-25 15:30 – Updated: 2024-12-25 15:30Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
{
"affected": [],
"aliases": [
"CVE-2024-53291"
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-25T15:15:07Z",
"severity": "HIGH"
},
"details": "Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.",
"id": "GHSA-hcvh-mwx3-f4mp",
"modified": "2024-12-25T15:30:43Z",
"published": "2024-12-25T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53291"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000258904/dsa-2024-488-security-update-for-dell-nativeedge-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HF52-78X8-6W3W
Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-07-09 21:09Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:apache-activemq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:apache-activemq"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-broker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-broker"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-all"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.19.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-all"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49270"
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T21:09:08Z",
"nvd_published_at": "2026-06-01T09:16:20Z",
"severity": "MODERATE"
},
"details": "Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nBrokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker,\u00a0including client identifiers, subscription names, topic destinations, and\u00a0JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.",
"id": "GHSA-hf52-78x8-6w3w",
"modified": "2026-07-09T21:09:08Z",
"published": "2026-06-01T09:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49270"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/activemq"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/k3233c1x506z3w7x4z0dqvd86d4v2fr2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/31/22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability"
}
GHSA-J6G3-HR9Q-9XRQ
Vulnerability from github – Published: 2025-07-10 06:30 – Updated: 2025-07-10 06:30In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.
{
"affected": [],
"aliases": [
"CVE-2023-50458"
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-10T04:15:37Z",
"severity": "LOW"
},
"details": "In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users\u0027 jobs.",
"id": "GHSA-j6g3-hr9q-9xrq",
"modified": "2025-07-10T06:30:19Z",
"published": "2025-07-10T06:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50458"
},
{
"type": "WEB",
"url": "https://github.com/dradis/dradis-ce/tags"
},
{
"type": "WEB",
"url": "https://securiteam.io/2025/07/03/cve-2023-50458-dradis-information-disclosure-output-console"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MPGX-6896-6PG4
Vulnerability from github – Published: 2025-08-27 12:30 – Updated: 2025-08-27 12:30The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources.
{
"affected": [],
"aliases": [
"CVE-2025-30038"
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-27T11:15:33Z",
"severity": "HIGH"
},
"details": "The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources.",
"id": "GHSA-mpgx-6896-6pg4",
"modified": "2025-08-27T12:30:26Z",
"published": "2025-08-27T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30038"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2025/08/CVE-2025-2313"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-Q6C6-5CWJ-R28C
Vulnerability from github – Published: 2025-08-06 09:30 – Updated: 2025-08-06 09:30Information disclosure while accessing and modifying the PIB file of a remote device via powerline.
{
"affected": [],
"aliases": [
"CVE-2025-47324"
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-06T08:15:30Z",
"severity": "HIGH"
},
"details": "Information disclosure while accessing and modifying the PIB file of a remote device via powerline.",
"id": "GHSA-q6c6-5cwj-r28c",
"modified": "2025-08-06T09:30:36Z",
"published": "2025-08-06T09:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47324"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJQ5-7G6P-P3VG
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.
{
"affected": [],
"aliases": [
"CVE-2024-9099"
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:47Z",
"severity": "HIGH"
},
"details": "In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.",
"id": "GHSA-qjq5-7g6p-p3vg",
"modified": "2025-03-20T12:32:50Z",
"published": "2025-03-20T12:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9099"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/ffb84fe8-3e60-4200-ac2d-1fd1e1c93e91"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QRCV-JF73-5VRQ
Vulnerability from github – Published: 2024-05-02 18:30 – Updated: 2024-05-02 18:30The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts.
{
"affected": [],
"aliases": [
"CVE-2023-6962"
],
"database_specific": {
"cwe_ids": [
"CWE-1230",
"CWE-922"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-02T17:15:08Z",
"severity": "MODERATE"
},
"details": "The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts.",
"id": "GHSA-qrcv-jf73-5vrq",
"modified": "2024-05-02T18:30:51Z",
"published": "2024-05-02T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6962"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3071453%40wp-meta-seo%2Ftrunk\u0026old=3068145%40wp-meta-seo%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0323b54b-c15b-4d2d-9e8f-3df87c84dd49?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WM3C-F3VH-3XR4
Vulnerability from github – Published: 2026-06-02 00:31 – Updated: 2026-06-02 00:31Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.
{
"affected": [],
"aliases": [
"CVE-2025-59601"
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-01T23:16:15Z",
"severity": "MODERATE"
},
"details": "Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.",
"id": "GHSA-wm3c-f3vh-3xr4",
"modified": "2026-06-02T00:31:57Z",
"published": "2026-06-02T00:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59601"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.