Social security numbers disclosed

Description: Social security numbers disclosed

Applications sometimes disclose sensitive personal information such as social security numbers. Responses containing social security numbers may not represent any security vulnerability - for example, a number may belong to the logged-in user to whom it is displayed. If a social security number is identified during a security assessment it should be verified, then application logic reviewed to identify whether its disclosure within the application is necessary and appropriate.

References

• Web Security Academy: Information disclosure

Vulnerability classifications

• CWE-200: Information Exposure
• CAPEC-37: Retrieve Embedded Sensitive Data

Typical severity

Information

Type index (hex)

0x00600400

Type index (decimal)

6292480