A3: Sensitive Data Exposure · 2017

Sensitive data is exposed when cryptographic controls are missing or unsuitable algorithms, protocols, keys or settings are used.

Summary

Sensitive data is exposed when cryptographic controls are missing or unsuitable algorithms, protocols, keys or settings are used.

How the attack works

An application sends personal data over HTTP; a network observer can read the response without breaking encryption.

Example

Vulnerable · Pseudocode

GET http://shop.example/profile
200 OK
{"email": "alice@example.test"}

Fix: Use HTTPS throughout the site, HSTS and minimize the sensitive data sent.

Prevention

Classify and minimize stored sensitive data.
Use modern encryption for data in transit and at rest.
Manage keys outside the code and rotate them through controlled processes.

Lineage

2013 · A6: Sensitive Data Exposure Moves up to rank 3 in 2017
2017 · A3: Sensitive Data Exposure Renamed in 2021
2021 · A02: Cryptographic Failures Renamed from Sensitive Data Exposure
2025 · A04: Cryptographic Failures Moves down from rank 2

2013:A6 → 2017:A3: Sensitive Data Exposure moves up to rank 3.
2017:A3 → 2021:A02: Sensitive Data Exposure is reframed as Cryptographic Failures.
2021:A02 → 2025:A04: Cryptographic Failures moves down from rank 2 to 4.

Sources

Open official source ↗

Buy me a coffee