CWE · MITRE source
CWE-213Exposure of Sensitive Information Due to Incompatible Policies
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
When handling information, the developer must consider whether the information is regarded as sensitive by different stakeholders, such as users or administrators. Each stakeholder effectively has its own intended security policy that the product is expected to uphold. When a developer does not treat that information as sensitive, this can introduce a vulnerability that violates the expectations of the product's users.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (3)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
PT-2 | Authority to Process Personally Identifiable Information | PT | Demands documented authority and policy alignment for PII processing, reducing exposure due to incompatible or absent policies. |
PT-3 | Personally Identifiable Information Processing Purposes | PT | Directly enforces purpose compatibility and policy alignment for PII processing, preventing exposure from incompatible policies. |
PE-22 | Component Marking | PE | Marking hardware components with the permitted impact or classification level directly supports consistent policy enforcement, reducing the chance that sensitive data is processed on an incompatible component and thereby exposed. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2019-1010283 | 1.5 | 7.5 | 0.0027 | 2019-07-17 |
CVE-2022-30350 | 1.5 | 7.5 | 0.0037 | 2023-03-30 |
CVE-2023-6517 | 1.5 | 7.5 | 0.0009 | 2024-02-08 |
CVE-2022-22541 | 1.3 | 6.5 | 0.0029 | 2022-04-12 |
CVE-2024-7267 | 1.3 | 6.5 | 0.0027 | 2024-08-07 |
CVE-2023-3441 | 1.3 | 6.6 | 0.0011 | 2024-10-01 |
CVE-2025-54831 | 1.3 | 6.5 | 0.0008 | 2025-09-26 |
CVE-2019-10246 | 1.2 | 5.3 | 0.0258 | 2019-04-22 |
CVE-2019-10247 | 1.2 | 5.3 | 0.0310 | 2019-04-22 |
CVE-2017-3211 | 1.1 | 5.3 | 0.0027 | 2020-01-15 |
CVE-2020-1652 | 1.1 | 5.6 | 0.0048 | 2020-07-17 |
CVE-2023-36919 | 1.1 | 5.3 | 0.0053 | 2023-07-11 |
CVE-2023-40570 | 1.1 | 5.3 | 0.0032 | 2023-08-25 |
CVE-2024-49354 | 1.1 | 5.3 | 0.0011 | 2025-01-18 |
CVE-2025-24316 | 1.1 | 5.3 | 0.0011 | 2025-02-28 |
CVE-2023-27465 | 0.9 | 4.6 | 0.0013 | 2023-06-13 |
CVE-2024-44121 | 0.9 | 4.3 | 0.0014 | 2024-09-10 |
CVE-2025-32791 | 0.9 | 4.3 | 0.0020 | 2025-04-16 |
CVE-2025-4976 | 0.9 | 4.3 | 0.0003 | 2025-07-24 |
CVE-2022-33692 | 0.8 | 4.0 | 0.0002 | 2022-07-12 |
CVE-2022-33694 | 0.8 | 4.0 | 0.0002 | 2022-07-12 |
CVE-2022-33696 | 0.8 | 4.0 | 0.0002 | 2022-07-12 |
CVE-2022-39848 | 0.8 | 4.0 | 0.0002 | 2022-10-07 |
CVE-2023-5117 | 0.7 | 3.7 | 0.0013 | 2024-12-25 |
CVE-2024-49827 | 0.7 | 3.7 | 0.0004 | 2025-08-18 |