Cyber Resilience

CWE · MITRE source

CWE-212Improper Removal of Sensitive Information Before Storage or Transfer

Abstraction: Base · CVEs in our corpus: 120

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Resources that may contain sensitive data include documents, packets, messages, databases, etc. While this data may be useful to an individual user or small set of users who share the resource, it may need to be removed before the resource can be shared outside of the trusted group. The process of removal is sometimes called cleansing or scrubbing. For example, a product for editing documents might not remove sensitive data such as reviewer comments or the local pathname where the document is stored. Or, a proxy might not remove an internal IP address from headers before making an outgoing request to an Internet site.

Last updated: 21 August 2026 14:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 5 mapping(s) from 3 framework(s): STIG oracle linux 8 3 (mostly) · STIG rhel 8 1 (partial) · STIG oracle linux 9 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-12 Information Management and Retention
  • SI-18 Personally Identifiable Information Quality Operations
  • SI-19 De-identification
  • SI-21 Information Refresh
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V14.2.8
  • V14.3.3

NIST 800-53 r5 controls that address this weakness (8)AI-assisted

Showing the 7 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
SI-12Information Management and RetentionSIRetention policies enforce removal or sanitization of sensitive data before storage or transfer per regulatory requirements.
SI-18Personally Identifiable Information Quality OperationsSIThe explicit requirement to delete inaccurate/outdated PII implements proper removal of sensitive information before further storage or transfer.
SI-19De-identificationSIThe control implements proper removal of sensitive information before storage or transfer of datasets.
IR-9Information Spillage ResponseIREradication of spilled information from contaminated systems mitigates the effects of improper removal of sensitive data before storage or transfer.
MP-8Media DowngradingMPThe control requires verified removal of sensitive data before media is made available at a reduced classification level, directly addressing improper removal prior to storage or transfer.
PM-22Personally Identifiable Information Quality ManagementPMExplicit procedures to delete inaccurate or outdated PII directly mitigate improper removal of sensitive information before storage or transfer.
SR-12Component DisposalSRRequires explicit removal of sensitive information prior to component transfer or disposal, reducing exposure from retained data.
Show 1 more broadly-applicable controls
SI-21Information RefreshSIThe generate-on-demand-and-delete requirement enforces removal of sensitive information before storage or transfer, preventing improper retention.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-2818 7.69.80.01622022-08-15
CVE-2020-11684 7.19.10.01082020-09-14
CVE-2019-13402 6.98.80.01522019-07-08
CVE-2021-0340 6.98.80.02062021-02-10
CVE-2022-0355 6.98.80.02022022-01-26
CVE-2022-30617 6.88.80.01452022-05-19
CVE-2026-42880 6.89.60.00512026-05-07
CVE-2020-1940 6.57.50.04512020-01-28
CVE-2022-1650 6.58.10.01852022-05-12
CVE-2022-31112 6.58.20.01242022-06-30
CVE-2002-0704 6.47.50.03242002-07-26
CVE-2019-11243 6.48.10.01492019-04-22
CVE-2022-39393 6.38.60.00692022-11-10
CVE-2018-6337 6.27.50.01782018-12-31
CVE-2019-20637 6.27.50.01752020-04-08
CVE-2020-15094 6.28.00.03042020-09-02
CVE-2020-36476 6.27.50.01552021-08-23
CVE-2022-31042 6.27.50.01862022-06-10
CVE-2022-31043 6.27.50.01862022-06-10
CVE-2022-4734 6.28.10.00772022-12-27
CVE-2021-31780 6.17.50.01052021-04-23
CVE-2022-23633 6.17.40.02232022-02-11
CVE-2022-24798 6.17.50.01422022-03-31
CVE-2024-49997 6.17.50.01062024-10-21
CVE-2026-32891 6.19.00.00162026-03-20