CWE-598Use of HTTP Request With Sensitive Query String

Abstraction: Variant · CVEs in our corpus: 91

The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Last updated: 20 August 2026 13:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A06:2025 Insecure Design.

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

Control	Title	Family	Why it addresses this CWE
`SC-9`	Transmission Confidentiality	SC	Protects sensitive data placed in query strings from interception in transit when confidentiality controls like HTTPS are enforced.

CVE	Risk	CVSS	EPSS	Published
`CVE-2017-3185`	7.8	9.8	0.0322	2017-12-16
`CVE-2018-14822`	7.8	9.8	0.0292	2018-10-02
`CVE-2023-6014`	7.5	9.8	0.0116	2023-11-16
`CVE-2025-69270`	7.2	9.8	0.0029	2026-01-12
`CVE-2026-74880`	7.2	9.8	0.0031	2026-08-17
`CVE-2019-18573`	6.7	8.8	0.0099	2019-12-18
`CVE-2020-5331`	6.7	8.8	0.0072	2020-05-04
`CVE-2021-36328`	6.7	8.8	0.0084	2021-11-30
`CVE-2025-57800`	6.6	8.8	0.0046	2025-08-22
`CVE-2021-21594`	6.4	8.2	0.0081	2021-08-16
`CVE-2025-50110`	6.4	8.8	0.0027	2025-09-15
`CVE-2019-6531`	6.3	8.1	0.0102	2019-04-02
`CVE-2022-22551`	6.2	8.3	0.0039	2022-01-21
`CVE-2024-31206`	6.2	8.2	0.0033	2024-04-04
`CVE-2025-56551`	6.2	8.2	0.0034	2025-10-03
`CVE-2026-23846`	6.1	8.1	0.0041	2026-01-19
`CVE-2025-69634`	6.1	9.0	0.0014	2026-02-12
`CVE-2026-54652`	6.0	8.1	0.0023	2026-07-08
`CVE-2022-24414`	5.9	7.6	0.0062	2022-05-26
`CVE-2026-34020`	5.9	7.5	0.0051	2026-04-09
`CVE-2024-23766`	5.8	7.5	0.0044	2024-06-26
`CVE-2024-38863`	5.8	7.5	0.0042	2024-10-14
`CVE-2025-22387`	5.8	7.5	0.0037	2025-01-04
`CVE-2025-26473`	5.8	7.5	0.0045	2025-02-13
`CVE-2021-41719`	5.8	7.5	0.0036	2025-03-04