CVE-2023-34467

Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.

The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.

The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.

Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.

Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.

Controlling internal connections prevents exposure of resources to unintended internal spheres.

Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.

The control prevents exposure of the media resource to the wrong security sphere.

Information-transfer rules can prevent unintended disclosure of private resources outside the product.

Access-control mechanisms limit who can receive resources that should remain internal.

A.5.18 governs the provisioning, review, and revocation of authorized access rights to already-authenticated identities; it has no bearing on whether a product transmits a private resource into an untrusted sphere during its own operation.

Data-leakage-prevention technologies specifically block unintended transmission of sensitive resources.

A.8.3's core (access restriction per policies, per-user/group rights, isolation, dynamic techniques, authentication, time-bound access, encryption, monitoring, alerts) directly stops untrusted parties from exploiting leaked private resources in most transmission scenarios; the bounded remainder is cases where the leak is not an access-control decision at all (e.g. the resource is deliberately public but still contains unintended private data).