CWE-212: Cross-boundary Cleansing Information Leak
Cross-boundary Cleansing Information Leak
Weakness ID: 212 (Weakness Base)
Status: Incomplete
Description
Description Summary
The software does not properly remove sensitive data from a
source when preparing it for, or transferring it to, an untrusted
destination.
Extended Description
An example of a cross-boundary cleansing information leak would be if an
internal IP address might be discovered. This discloses information about
the IP addressing scheme of the internal network and can be valuable to
attackers.
An example of a cross-boundary cleansing information leak would be if an
internal IP address might be discovered. The leak discloses information
about the IP addressing scheme of the internal network and can be valuable
to attackers. Another example would be features in software that export or
copy documents without removing sensitive information such as edit history
in a Word and PDF.
NAT feature in firewall leaks internal IP
addresses in ICMP error messages.
Potential Mitigations
Phase
Description
Compartmentalize your system to have "safe" areas where trust
boundaries can be unambiguously drawn. Do not allow sensitive data to go
outside of the trust boundary and always be careful when interfacing
with a compartment outside of the safe area.
This entry is intended to be different from resultant information leaks,
including those that occur from improper buffer initialization and reuse,
interaction errors, and multiple interpretation errors. This entry could be
regarded as a privacy leak.
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
PLOVER
Cross-Boundary Cleansing Infoleak
Content History
Submissions
Submission Date
Submitter
Organization
Source
PLOVER
Externally Mined
Modifications
Modification Date
Modifier
Organization
Source
2008-07-01
Eric Dalci
Cigital
External
updated Time of Introduction
2008-09-08
CWE Content Team
MITRE
Internal
updated Relationships, Other Notes,
Taxonomy Mappings
2008-10-14
CWE Content Team
MITRE
Internal
updated Description
2009-10-29
CWE Content Team
MITRE
Internal
updated Description, Other Notes,
Relationship Notes