Sensitive Information Disclosure
Medium · Configuration
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-200
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-200
Definition
Verbose errors, public buckets, debug endpoints leak secrets.
Root cause
Debug mode; misconfigured storage.
Affected components
- Components in the “Configuration” class
- Application / API handlers
- Supporting libraries
Impact
Credential/PII leak.
Severity
Medium · CVSS 5.3
Safe lab reproduction
Cloud posture labs
Detection methodology
DAST; error page review; cloud scans.
Evidence examples
- Lab reproduction notes: Cloud posture labs
- Request/response excerpts (redacted)
- Detection signal: DAST; error page review; cloud scans
Remediation
Custom errors; access controls; data classification.
Secure coding examples
Redact logs; scan for secrets.
Related CYNARKS lessons & labs
Tools: prowler
Practise related skills in Labs or deepen on Academy library.