CWE · MITRE source
CWE-213Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
When handling information, the developer must consider whether the information is regarded as sensitive by different stakeholders, such as users or administrators. Each stakeholder effectively has its own intended security policy that the product is expected to uphold. When a developer does not treat that information as sensitive, this can introduce a vulnerability that violates the expectations of the product's users.
Last updated: 15 October 2026 14:21 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 2 mapping(s) from 2 framework(s): STIG ubuntu 24 04 1 (partial) · STIG windows server 2019 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
- 3 hardening rules · 3 OS baselines
V4.1.2V14.1.1
NIST 800-53 r5 controls PROPOSED for this weakness (3)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
PT-2 | Authority to Process Personally Identifiable Information | PT | Demands documented authority and policy alignment for PII processing, reducing exposure due to incompatible or absent policies. |
PT-3 | Personally Identifiable Information Processing Purposes | PT | Directly enforces purpose compatibility and policy alignment for PII processing, preventing exposure from incompatible policies. |
PE-22 | Component Marking | PE | Marking hardware components with the permitted impact or classification level directly supports consistent policy enforcement, reducing the chance that sensitive data is processed on an incompatible component and thereby exposed. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2026-33216 UPD | 6.3 | 8.6 | 0.0063 | 2026-03-25 |
CVE-2019-1010283 UPD | 6.1 | 7.5 | 0.0145 | 2019-07-17 |
CVE-2022-30350 UPD | 6.0 | 7.5 | 0.0073 | 2023-03-30 |
CVE-2023-6517 UPD | 5.9 | 7.5 | 0.0048 | 2024-02-08 |
CVE-2025-54831 UPD | 5.3 | 6.5 | 0.0091 | 2025-09-26 |
CVE-2019-10247 UPD | 5.2 | 5.3 | 0.0594 | 2019-04-22 |
CVE-2022-22541 UPD | 5.2 | 6.5 | 0.0079 | 2022-04-12 |
CVE-2024-7267 UPD | 5.2 | 6.5 | 0.0060 | 2024-08-07 |
CVE-2026-6280 | 5.1 | 6.5 | 0.0038 | 2026-07-08 |
CVE-2019-10246 UPD | 5.0 | 5.3 | 0.0409 | 2019-04-22 |
CVE-2023-3441 UPD | 4.9 | 6.6 | 0.0055 | 2024-10-01 |
CVE-2020-1652 UPD | 4.7 | 5.6 | 0.0074 | 2020-07-17 |
CVE-2023-36919 UPD | 4.5 | 5.3 | 0.0048 | 2023-07-11 |
CVE-2023-40570 UPD | 4.5 | 5.3 | 0.0056 | 2023-08-25 |
CVE-2017-3211 UPD | 4.4 | 5.3 | 0.0083 | 2020-01-15 |
CVE-2024-49354 UPD | 4.4 | 5.3 | 0.0034 | 2025-01-18 |
CVE-2025-24316 UPD | 4.4 | 5.3 | 0.0031 | 2025-02-28 |
CVE-2026-55425 UPD | 4.0 | 5.0 | 0.0041 | 2026-08-28 |
CVE-2023-27465 UPD | 3.7 | 4.6 | 0.0028 | 2023-06-13 |
CVE-2025-4976 UPD | 3.7 | 4.3 | 0.0049 | 2025-07-24 |
CVE-2024-44121 UPD | 3.6 | 4.3 | 0.0029 | 2024-09-10 |
CVE-2025-32791 UPD | 3.6 | 4.3 | 0.0029 | 2025-04-16 |
CVE-2022-33692 UPD | 3.2 | 4.0 | 0.0010 | 2022-07-12 |
CVE-2022-33694 UPD | 3.2 | 4.0 | 0.0010 | 2022-07-12 |
CVE-2022-33696 UPD | 3.2 | 4.0 | 0.0010 | 2022-07-12 |