What Is Sensitive Data Exposure?

Sensitive data exposure is the outcome in which an application reveals protected information to someone not authorized to have it, whatever the weakness that allowed it. The nearest entry in MITRE's catalog is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.

A data breach names the reportable incident, the point at which information is known to have reached somebody and notification duties attach under contract or statute. Exposure describes the condition behind it. Both OWASP and MITRE have since treated the phrase as naming a result, with the fault sitting somewhere underneath.

Why OWASP Renamed the Category Cryptographic Failures

Until 2021, the OWASP Top 10 carried a category called sensitive data exposure, placed third in the 2017 edition. The 2021 revision retired the name, recording the reason in a single clause, that it was "more of a broad symptom rather than a root cause." The 2025 edition restates the position as keeping the focus on root cause over symptoms.

Failures tied to absent cryptography, cryptography too weak for its job, and leaked cryptographic keys are what the current edition puts in the category. Fourth place is where it sits after a drop of two positions.

Across the current edition, OWASP maps 32 weakness classes into cryptographic failures. Weak random number generation sits among the most common of them, alongside broken algorithms and insufficient entropy. The tally behind that category runs to 1,665,348 recorded occurrences across 2,185 CVEs, with an average incidence rate of 3.80% of the applications tested. Its average weighted exploit score is 7.23, against an average weighted impact of 3.90.

MITRE Discourages Mapping Vulnerabilities to CWE-200

The vulnerability mapping field on CWE-200 is set to DISCOURAGED. The identifier should not be used for real-world vulnerabilities at all. Three reasons are recorded against it: frequent misuse, frequent misinterpretation, and abstraction. The last of these is its Class-level position in the catalog.

Because confidentiality loss is what MITRE calls a technical impact rather than the error behind it, naming the loss identifies almost nothing about the defect. As of CWE version 4.9, more than 400 entries in the catalog can produce that loss. The instruction attached to the entry is to use the identifier for the mistake, with six candidates named, among them inserting sensitive data into files and observable discrepancies in behavior. Rank 20 of the 2025 CWE Top 25 still belongs to CWE-200, a place it held through a remapping exercise aimed at abstract entries of exactly this kind across 9,468 CVE records, 24% of the dataset.

The illustration MITRE gives is an out-of-bounds read that reaches sensitive memory. The read is the primary weakness there, whatever it happened to touch. Advisories reach for the term Information Disclosure instead, which the note against CWE-200 says gets applied to any vulnerability involving a loss of confidentiality. Where the entry names a mechanism, the mapping is marked ALLOWED, cleartext transmission and insertion of sensitive information into a log file among them.

One term the catalog is actively avoiding is leak, which MITRE notes already carries a second meaning in constructions like memory leak, where it describes resources that were never released back. Habit outlasts guidance even inside the catalog, where Exposure of Private Personal Information, CWE-359, still lists privacy leak among its alternate terms alongside PII and PHI.

What Counts as Sensitive Data?

CWE-200's enumeration of sensitive information runs well past personal data. Alongside personal messages, financial data, health records, location or contact details, it counts system status, installed packages, business secrets, network configuration, plus an application's own code and internal state. Metadata belongs there too, logged connections and message headers among the examples given. Indirect information closes the list, meaning any gap between two internal operations that shows from outside.

Sensitivity is relative to a party as much as to a category, with four parties named. Users come first, then people and organizations whose information the application holds without their being users of it, then administrators of the systems and networks it runs on, and the developer last. A version banner is sensitive to nobody in the first two groups and useful to an attacker studying the third.

Where Data Exposure Happens With No Cryptography Involved

Encryption addresses one route to disclosure, leaving the others untouched. Plaintext records in a log file, a stack trace returned to a browser, a readable backup, and a response that differs for valid and invalid accounts all produce data exposure with no cipher involved. Each belongs to a different family in this catalog of application security vulnerabilities.

The same outcome arrives through access control, with no mishandling of the data itself. Improper authorization, insecure permissions and broken authentication all end with information reaching the wrong actor, which is why half of MITRE's six replacement suggestions for CWE-200 name authorization, permissions or authentication.

A weakness class tells a team where to look in the code. Raven watches what the running application hands back, so a response carrying data the caller had no right to receive is caught as it leaves, whatever weakness put it there. Book a demo and point it at your own traffic.

‍