CWE-497
AllowedExposure of Sensitive System Information to an Unauthorized Control Sphere
Abstraction: Base · Status: Incomplete
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
734 vulnerabilities reference this CWE, most recent first.
GHSA-W5VR-6QHR-36CC
Vulnerability from github – Published: 2023-08-14 21:10 – Updated: 2025-07-28 15:53Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.
Such APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the S part of the signature, but not in the R value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same R and only differ on the S part.
Unfortunately, when this happens, one can easily extract the private key.
Revised public APIs in v2.0 of ed25519-dalek do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled "hazmat" APIs which are clearly labeled as being dangerous if misused.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "ed25519-dalek"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-50237"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-14T21:10:29Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Versions of `ed25519-dalek` prior to v2.0 model private and public keys as separate types which can be assembled into a `Keypair`, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.\n\nSuch APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the `S` part of the signature, but not in the `R` value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same `R` and only differ on the `S` part.\n\nUnfortunately, when this happens, one can easily extract the private key.\n\nRevised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled \"hazmat\" APIs which are clearly labeled as being dangerous if misused.",
"id": "GHSA-w5vr-6qhr-36cc",
"modified": "2025-07-28T15:53:32Z",
"published": "2023-08-14T21:10:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50237"
},
{
"type": "WEB",
"url": "https://github.com/MystenLabs/ed25519-unsafe-libs"
},
{
"type": "PACKAGE",
"url": "https://github.com/dalek-cryptography/ed25519-dalek"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2022-0093.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "`ed25519-dalek` Double Public Key Signing Function Oracle Attack"
}
GHSA-W6CM-9C76-C988
Vulnerability from github – Published: 2022-09-02 00:01 – Updated: 2022-09-08 00:00A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.
{
"affected": [],
"aliases": [
"CVE-2022-2403"
],
"database_specific": {
"cwe_ids": [
"CWE-497",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-01T21:15:00Z",
"severity": "MODERATE"
},
"details": "A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.",
"id": "GHSA-w6cm-9c76-c988",
"modified": "2022-09-08T00:00:29Z",
"published": "2022-09-02T00:01:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2403"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:5664"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:5879"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-2403"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2101959"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W8HJ-X5G8-W28F
Vulnerability from github – Published: 2025-10-06 09:30 – Updated: 2025-10-06 09:30Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.
{
"affected": [],
"aliases": [
"CVE-2025-58579"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-06T07:15:34Z",
"severity": "MODERATE"
},
"details": "Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.",
"id": "GHSA-w8hj-x5g8-w28f",
"modified": "2025-10-06T09:30:19Z",
"published": "2025-10-06T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58579"
},
{
"type": "WEB",
"url": "https://sick.com/psirt"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"type": "WEB",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf"
},
{
"type": "WEB",
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W962-XQHV-V77R
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-14 15:30Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.7.0.
{
"affected": [],
"aliases": [
"CVE-2026-39516"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T09:16:25Z",
"severity": "MODERATE"
},
"details": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through \u003c= 4.7.0.",
"id": "GHSA-w962-xqhv-v77r",
"modified": "2026-04-14T15:30:28Z",
"published": "2026-04-08T09:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39516"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/the-plus-addons-for-block-editor/vulnerability/wordpress-nexter-blocks-plugin-4-7-0-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W9Q3-G4P5-5Q2R
Vulnerability from github – Published: 2025-05-13 20:05 – Updated: 2025-05-13 20:05Summary
Users with limited sudo privileges (e.g. execution of a single command) can list sudo privileges of other users using the -U flag. This doesn't happen with the original sudo.
PoC
The initial test has been done in a container running Ubuntu 24.04 and installing oxidizr, running sudo-rs 0.2.2.
A user (bob) has been added with only ps command executable through sudo:
root ALL=(ALL:ALL) ALL
bob ALL=(ALL:ALL) /usr/bin/ps
The user is not able to read the /etc/sudoers file and running sudo -l -Uroot with original sudo (version 1.9.15p5) causes the following error:
Sorry, user bob is not allowed to execute 'list' as root on 43d4aed3cdbd.
The same command with sudo-rs is run without denying the execution:
User root may run the following commands on 43d4aed3cdbd:
(ALL : ALL) ALL
The same happens for other non-root users:
bob@43d4aed3cdbd:~$ sudo -l -Ufoo
User foo may run the following commands on 43d4aed3cdbd:
(ALL : ALL) /usr/bin/whoami
The behavior has been also been observed for version 0.2.5.
Impact
Users with limited sudo privileges can enumerate the sudoers file, revealing sensitive information about other users' permissions. Attackers can collect information that can be used to more targeted attacks.
Systems where users either do not have sudo privileges or have the ability to run all commands as root through sudo (the default configuration on most systems) are not affected by this advisory.
Credits
This issue was identified by Sonia Zorba.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "sudo-rs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-46718"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-13T20:05:55Z",
"nvd_published_at": "2025-05-12T15:16:01Z",
"severity": "LOW"
},
"details": "### Summary\nUsers with limited sudo privileges (e.g. execution of a single command) can list sudo privileges of other users using the `-U` flag. This doesn\u0027t happen with the original sudo.\n\n### PoC\n\nThe initial test has been done in a container running Ubuntu 24.04 and installing [oxidizr](https://github.com/jnsgruk/oxidizr), running sudo-rs 0.2.2.\n\nA user (bob) has been added with only ps command executable through sudo:\n\n```\nroot ALL=(ALL:ALL) ALL\nbob ALL=(ALL:ALL) /usr/bin/ps\n```\n\nThe user is not able to read the `/etc/sudoers` file and running `sudo -l -Uroot` with original sudo (version 1.9.15p5) causes the following error:\n\n```\nSorry, user bob is not allowed to execute \u0027list\u0027 as root on 43d4aed3cdbd.\n```\n\nThe same command with sudo-rs is run without denying the execution:\n\n```\nUser root may run the following commands on 43d4aed3cdbd:\n (ALL : ALL) ALL\n```\n\nThe same happens for other non-root users:\n\n```\nbob@43d4aed3cdbd:~$ sudo -l -Ufoo\nUser foo may run the following commands on 43d4aed3cdbd:\n (ALL : ALL) /usr/bin/whoami\n```\n\nThe behavior has been also been observed for version 0.2.5.\n\n### Impact\nUsers with limited sudo privileges can enumerate the sudoers file, revealing sensitive information about other users\u0027 permissions. Attackers can collect information that can be used to more targeted attacks.\n\nSystems where users either do not have sudo privileges or have the ability to run all commands as root through sudo (the default configuration on most systems) are not affected by this advisory.\n\n### Credits\nThis issue was identified by [Sonia Zorba](https://www.zonia3000.net/).",
"id": "GHSA-w9q3-g4p5-5q2r",
"modified": "2025-05-13T20:05:55Z",
"published": "2025-05-13T20:05:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-w9q3-g4p5-5q2r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46718"
},
{
"type": "PACKAGE",
"url": "https://github.com/trifectatechfoundation/sudo-rs"
},
{
"type": "WEB",
"url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others"
}
GHSA-WCHM-6X5M-J87P
Vulnerability from github – Published: 2025-09-16 00:30 – Updated: 2025-09-16 15:32This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 26 and iPadOS 26. Keyboard suggestions may display sensitive information on the lock screen.
{
"affected": [],
"aliases": [
"CVE-2025-24133"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T23:15:29Z",
"severity": "MODERATE"
},
"details": "This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 26 and iPadOS 26. Keyboard suggestions may display sensitive information on the lock screen.",
"id": "GHSA-wchm-6x5m-j87p",
"modified": "2025-09-16T15:32:30Z",
"published": "2025-09-16T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24133"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125108"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WFPP-6H7F-CMMC
Vulnerability from github – Published: 2026-02-03 00:30 – Updated: 2026-02-03 00:30IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.
{
"affected": [],
"aliases": [
"CVE-2025-36238"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-02T23:15:59Z",
"severity": "MODERATE"
},
"details": "IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.",
"id": "GHSA-wfpp-6h7f-cmmc",
"modified": "2026-02-03T00:30:18Z",
"published": "2026-02-03T00:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36238"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7257556"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WGMV-VVVJ-JCFH
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.
{
"affected": [],
"aliases": [
"CVE-2026-66444"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T14:17:05Z",
"severity": "MODERATE"
},
"details": "Subscriber Sensitive Data Exposure in Payment Forms for Paystack \u003c= 4.0.5 versions.",
"id": "GHSA-wgmv-vvvj-jcfh",
"modified": "2026-08-13T15:34:40Z",
"published": "2026-08-13T15:34:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66444"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/payment-forms-for-paystack/vulnerability/wordpress-payment-forms-for-paystack-plugin-4-0-5-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WGPV-C3R2-3V2F
Vulnerability from github – Published: 2025-06-20 15:30 – Updated: 2026-04-01 15:30Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid allows Retrieve Embedded Sensitive Data. This issue affects ProfileGrid : from n/a through 5.9.5.2.
{
"affected": [],
"aliases": [
"CVE-2025-52719"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-20T15:15:32Z",
"severity": "MODERATE"
},
"details": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid allows Retrieve Embedded Sensitive Data. This issue affects ProfileGrid : from n/a through 5.9.5.2.",
"id": "GHSA-wgpv-c3r2-3v2f",
"modified": "2026-04-01T15:30:45Z",
"published": "2025-06-20T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52719"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-5-2-full-path-disclosure-fpd-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WGX8-MFG5-P253
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-29 12:33Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.
{
"affected": [],
"aliases": [
"CVE-2026-39686"
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T09:16:40Z",
"severity": "MODERATE"
},
"details": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through \u003c= 3.7.2.",
"id": "GHSA-wgx8-mfg5-p253",
"modified": "2026-04-29T12:33:03Z",
"published": "2026-04-08T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39686"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/bsk-pdf-manager/vulnerability/wordpress-bsk-pdf-manager-plugin-3-7-2-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs
CAPEC-170: Web Application Fingerprinting
An attacker sends a series of probes to a web application in order to elicit version-dependent and type-dependent behavior that assists in identifying the target. An attacker could learn information such as software versions, error pages, and response headers, variations in implementations of the HTTP protocol, directory structures, and other similar information about the targeted service. This information can then be used by an attacker to formulate a targeted attack plan. While web application fingerprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
CAPEC-694: System Location Discovery
An adversary collects information about the target system in an attempt to identify the system's geographical location.
Information gathered could include keyboard layout, system language, and timezone. This information may benefit an adversary in confirming the desired target and/or tailoring further attacks.