CWE · MITRE source
CWE-202Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
Last updated: 21 August 2026 07:11 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Detect
Catch it (CSF Detect / Respond)
DE.CM-03
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
—
NIST 800-53 r5 controls that address this weakness (0)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-59352 | 7.4 | 9.8 | 0.0073 | 2025-09-17 |
CVE-2021-32743 UPD | 6.9 | 8.8 | 0.0180 | 2021-07-15 |
CVE-2025-68456 | 6.9 | 9.1 | 0.0049 | 2026-01-05 |
CVE-2025-25205 UPD | 6.8 | 8.2 | 0.0433 | 2025-02-12 |
CVE-2025-69200 UPD | 6.2 | 7.5 | 0.0205 | 2025-12-29 |
CVE-2022-41623 UPD | 6.0 | 7.5 | 0.0077 | 2022-10-14 |
CVE-2024-2088 UPD | 6.0 | 8.5 | 0.0034 | 2024-05-22 |
CVE-2023-7072 UPD | 5.9 | 7.5 | 0.0062 | 2024-03-12 |
CVE-2024-6400 UPD | 5.9 | 7.5 | 0.0063 | 2024-10-04 |
CVE-2024-13255 UPD | 5.9 | 7.5 | 0.0050 | 2025-01-09 |
CVE-2026-30778 | 5.9 | 7.5 | 0.0054 | 2026-04-15 |
CVE-2026-40245 | 5.9 | 7.5 | 0.0051 | 2026-04-16 |
CVE-2025-29981 UPD | 5.8 | 7.5 | 0.0037 | 2025-04-02 |
CVE-2025-36575 UPD | 5.7 | 7.5 | 0.0029 | 2025-06-10 |
CVE-2023-1625 UPD | 5.6 | 7.4 | 0.0071 | 2023-09-24 |
CVE-2026-25703 | 5.6 | 7.3 | 0.0022 | 2026-08-05 |
CVE-2026-33530 | 5.5 | 7.7 | 0.0020 | 2026-03-26 |
CVE-2019-19000 UPD | 5.4 | 6.5 | 0.0108 | 2020-04-02 |
CVE-2022-20747 UPD | 5.3 | 6.5 | 0.0090 | 2022-04-15 |
CVE-2022-20810 UPD | 5.2 | 6.5 | 0.0069 | 2022-09-30 |
CVE-2024-38892 UPD | 5.1 | 6.5 | 0.0040 | 2024-06-24 |
CVE-2024-1287 UPD | 5.1 | 6.5 | 0.0052 | 2024-07-30 |
CVE-2023-20215 UPD | 4.6 | 5.8 | 0.0062 | 2023-08-03 |
CVE-2024-20388 UPD | 4.5 | 5.3 | 0.0043 | 2024-10-23 |
CVE-2021-1372 UPD | 4.4 | 5.5 | 0.0041 | 2021-02-17 |