CWE-612 Improper Authorization of Index Containing Sensitive Information
baseThe product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (13)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-3654US | critical9.8 | — | ||
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiti… | ||||
| CVE-2025-3653US | critical9.8 | — | ||
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by accepting arbitrary seria… | ||||
| CVE-2024-25635US | high8.8 | — | ||
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using th… | ||||
| CVE-2025-3660US | high8.2 | — | ||
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploitin… | ||||
| CVE-2018-15448US | high7.5 | — | ||
A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to discover sensitive user information. The at… | ||||
| CVE-2022-35980US | high7.5 | — | ||
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an info… | ||||
| CVE-2023-4560US | medium6.5 | — | ||
Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4. | ||||
| CVE-2022-41918US | medium6.3OT elevated | — | ||
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level secur… | ||||
| CVE-2021-47015US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix RX consumer index logic in the error path.
In bnxt_rx_pkt(), the RX buffers are expected to compl… | ||||
| CVE-2022-22565US | low3.8 | — | ||
Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information. An authenticated and privileged user could potentially exp… | ||||
| CVE-2019-25605US | — | — | ||
EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to capture sensitive user credentials by accessing developer console logs via Android Debug Bridge… | ||||
| CVE-2025-57756US | — | — | ||
Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and be… | ||||
| CVE-2024-49071US | — | — | ||
Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a n… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan