CWE-212 is Improper Removal of Sensitive Information Before Storage or Transfer. The flaw arises when the product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors. The database currently holds 36 vulnerabilities mapped to CWE-212 and none of them are in the CISA Known Exploited Vulnerabilities catalog.
Analyzing data...
No vulnerability data in CISA KEV for CWE-212
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Resources that may contain sensitive data include documents, packets, messages, databases, etc. While this data may be useful to an individual user or small set of users who share the resource, it may need to be removed before the resource can be shared outside of the trusted group. The process of removal is sometimes called cleansing or scrubbing.
For example, a product for editing documents might not remove sensitive data such as reviewer comments or the local pathname where the document is stored. Or, a proxy might not remove an internal IP address from headers before making an outgoing request to an Internet site.
| Impact | Scope | Explanation |
|---|---|---|
| Read Files or Directories, Read Application Data | Confidentiality | Sensitive data may be exposed to an unauthorized actor in another control sphere. This may have a wide range of secondary consequences that will depend on what data is exposed. One possibility is the exposure of system data - such as file locations, software versions, or device data - that allow an attacker to craft a specific, more effective attack. Alternately, insufficient redaction of Private Personal Information (PPI), Personally Identifiable Information (PII), or other types of information might not harm the secure operation of the product itself, but could be violations of expectations by the product's users. |
| Method | Approach | Effectiveness |
|---|---|---|
| Automated Static Analysis | Tools are available to analyze documents (such as PDF, Word, etc.) to look for private information such as names, addresses, etc. | - |
Below are representative vulnerabilities related to this CWE, prioritized by severity.
CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Review CyStack's security rating and practical recommendations for websites and edge assets.
Explore cybersecurity research from our team of security specialists.
Browse practical cybersecurity knowledge across CyStack's articles and guides.
en
