MITRE’s description of CWE-200: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Common consequences MITRE lists
- Confidentiality: Read Application Data
Leaked personal data, tokens, internal paths or stack traces either harm users directly or give attackers what they need for the next step. MITRE prefers mapping a finding to the specific cause, such as CWE-209 for error messages or CWE-532 for logs.
- Classify sensitive data and return only the fields each caller is entitled to see.
- Show generic error messages and keep diagnostic detail in protected logs.
- Mark private responses
Cache-Control: no-storeorprivateso shared caches cannot serve them to others. - Remove debug endpoints, directory listings and verbose headers from production.
Guides on this site
Ship without debug modes, verbose errors or exposed files
Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.
Handle failures without leaking internals or weakening controls
Give callers a useful, bounded response while preserving protected diagnostic evidence and safe application state.
Prevent shared-cache poisoning and private-response deception
Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.
Practice
- Repair a real proxy and shared cache · Local project
References
- CWE-200 in the MITRE CWE list (version 4.20)
- 2025 CWE Top 25 Most Dangerous Software Weaknesses (MITRE CWE Program)
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.