1 example
Information disclosure
Sensitive information exposed unintentionally.
[ FAQ1 ]
What is information disclosure?
Information disclosure is a security vulnerability where sensitive data such as internal error messages, stack traces, credentials, or private user information is accidentally revealed by an application. Often resulting from improper error handling or missing security headers, these disclosures can provide attackers with valuable insights into system architecture, application logic, or sensitive data. Information disclosure risks are highlighted by security organizations like OWASP as common vulnerabilities because they significantly increase the potential for targeted attacks or exploitation.
[ FAQ2 ]
How to prevent information disclosure vulnerabilities
To prevent information disclosure, implement strict error handling to ensure applications do not expose detailed internal error messages, stack traces, or debug information to end-users. Configure appropriate security headers (such as Content Security Policy, X-Content-Type-Options, and X-Frame-Options) to safeguard against unintended disclosures. Regularly scan and review application logs and responses to detect leaks of sensitive data proactively. Adopt secure coding standards recommended by OWASP, continuously train developers on privacy and security practices, and regularly conduct security assessments and penetration tests to uncover and address potential disclosure vulnerabilities.
diff block
greptile
logic: No validation of XML file existence or permissions before attempting to read. Could lead to information disclosure.
suggested fix
File d = new File(webGoatHomeDirectory, "ClientSideFiltering/employees.xml");
+ if (!d.exists() || !d.canRead()) {
+ throw new RuntimeException("Cannot access employees.xml file");
}