What Is Sensitive Data Exposure?

Sensitive data exposure occurs when an application does not have the proper measures to secure confidential information, such as passwords, credit card numbers, health records, and other personal data.

The root causes of such an exposure can vary, including weak passwords, lack of encryption, data storage and sharing practices, and human error. However, the Open Worldwide Application Security Project (OWASP) points out that the occurrence is a broad symptom of cryptographic failures, second on the list of OWASP Top 10 Vulnerabilities.

Read More about Sensitive Data Exposure

In 2017, sensitive data exposure was named one of the OWASP Top 10 Vulnerabilities. In 2021, OWASP renamed it to “Cryptographic Failures,” as they shifted to naming vulnerabilities based on their root causes. Learn about its specific causes and consequences below.

What Security Issues Can Lead to Sensitive Data Exposure ?

OWASP mapped Cryptographic Failures, previously known as “Sensitive Data Exposure,” to 29 security weaknesses found on the Common Weakness Enumeration (CWE) list, described in the table below. Any of these CWEs can expand an organization’s attack surface.

CWE	Description
CWE-261 Weak Encoding for Password	Passwords are stored or transmitted in a way that makes them vulnerable to attacks, such as weak hashing algorithms or plain text storage.
CWE-296 Improper Following of a Certificate’s Chain of Trust	The system fails to verify the authenticity and trustworthiness of digital certificates, which could lead to man-in-the-middle (MitM) attacks.
CWE-310 Cryptographic Issues	General cryptographic weaknesses, including improper use of cryptographic algorithms, weak key lengths, or poor random number generation.
CWE-319 Cleartext Transmission of Sensitive Information	Sensitive data is transmitted unencrypted, making it susceptible to interception and eavesdropping.
CWE-321 Use of Hard-Coded Cryptographic Key	Cryptographic keys are embedded directly into the code, making them vulnerable to exposure and compromise.
CWE-322 Key Exchange without Entity Authentication	Keys are exchanged without verifying the identity of the parties involved, potentially leading to MitM attacks.
CWE-323 Reusing a Nonce, Key Pair in Encryption	The same nonce or key pair is used multiple times, which compromises the reliability and security of the encryption.
CWE-324 Use of a Key Past Its Expiration Date	When cryptographic keys are used after their expiration date, the system’s security can become weak.
CWE-325 Missing Required Cryptographic Step	A crucial step in the cryptographic process is omitted, leaving the system vulnerable to attacks.
CWE-326 Inadequate Encryption Strength	Weak encryption algorithms or key lengths are used, making it easier for attackers to break the encryption.
CWE-327 Use of a Broken or Risky Cryptographic Algorithm	A weak or insecure cryptographic algorithm is used.
CWE-328 Reversible One-Way Hash	A one-way hash function is used in a way that allows the original data to be recovered from the hash.
CWE-329 Not Using a Random IV with CBC Mode	A predictable initialization vector (IV) is used with the Cipher Block Chaining (CBC) mode of operation, allowing attackers to exploit known patterns and potentially compromise the confidentiality of the encrypted data.
CWE-330 Use of Insufficiently Random Values	Random numbers or values used in cryptographic operations are not truly random, making them predictable and exploitable.
CWE-331 Insufficient Entropy	The random number generator lacks sufficient randomness. Attackers could easily predict the output.
CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)	A PRNG is an algorithm that produces a sequence of numbers that appear random but are actually generated based on a specific starting point or seed. These numbers are essential for various cryptographic applications, including generating keys, IVs, and salts. In CWE-335, the seeds used to initialize the PRNG are not properly chosen or used, leading to predictable outputs.
CWE-336 Same Seed in PRNG	The same seed is used multiple times, compromising the randomness of the generated numbers.
CWE-337 Predictable Seed in PRNG	The seed used to initialize the PRNG can be easily guessed or calculated, making it easy for attackers to predict the output.
CWE-338 Use of Cryptographically Weak PRNG	A weak PRNG is one that fails to produce truly random outputs, making systems vulnerable to various attacks, such as brute-force, replay, and MitM attacks.
CWE-340 Generation of Predictable Numbers or Identifiers	Numbers or identifiers used in cryptographic operations are not sufficiently random, making them predictable and exploitable.
CWE-347 Improper Verification of Cryptographic Signature	Cryptographic signatures are not properly verified, enabling attackers to forge signatures.
CWE-523 Unprotected Transport of Credentials	Credentials are transmitted without encryption, making them vulnerable to interception.
CWE-720 OWASP Top 10 2007 Category A9—Insecure Communications	CWE-720 refers to general insecure communication practices, such as using weak protocols or failing to encrypt sensitive data.
CWE-757 Selection of Less-Secure Algorithm During Negotiation (“Algorithm Downgrade”)	An attacker forces the use of a weaker cryptographic algorithm during a negotiation process.
CWE-759 Use of a One-Way Hash without a Salt	A salt is a random string of characters added to the password before hashing. This makes it more difficult for attackers to use precomputed hash tables. Even if two users have the same password, the addition of different salts will result in different hash values. In CWE-759, a one-way hash function is used without a salt, making it easier for attackers to crack passwords or other sensitive data.
CWE-760 Use of a One-Way Hash with a Predictable Salt	In contrast to CWE-759, CWE-760 involves using a predictable salt with a one-way hash function. However, the impact is the same—attackers could easily crack sensitive data like passwords and bank information.
CWE-780 Use of RSA Algorithm without Optimal Asymmetric Encryption Padding (OAEP)	The RSA algorithm is used without OAEP, a padding scheme that adds randomness to the plaintext before encryption. As a result, attackers can manipulate the ciphertext in a way that reveals information about the plaintext or private key.
CWE-818 Insufficient Transport Layer Protection	Weak encryption or authentication is used at the transport layer, making it easier for attackers to intercept and manipulate data. This CWE can lead to MitM, eavesdropping, and other attacks.
CWE-916 Use of Password Hash with Insufficient Computational Effort	Weak password hashing algorithms or insufficient iterations are used, making it easier for attackers to crack passwords.

What Are the Consequences of Sensitive Data Exposure ?

The repercussions of sensitive data exposure can be severe and far-reaching for both individuals and organizations.

Individuals

Cybercriminals can use exposed sensitive data for identity theft, assuming the data owner’s identity to commit fraud, such as applying for credit cards or loans. On the other hand, exposed financial data can lead to unauthorized transactions and financial damages.

Even without financial data in the mix, having one’s personal data exposed causes significant emotional distress and anxiety. For example, the database of a well-known dating application for military personnel was not encrypted and did not have proper password protection, potentially exposing the personal data of about 1.2 million military service members.

Organizations

The most obvious consequence of sensitive data exposure for organizations is reputational damage, which could ultimately lead to loss of customer trust and business. Organizations may also face legal and regulatory penalties for failing to protect sensitive data, especially in industries with strict compliance requirements. Operational disruption is also a common consequence.

Combined, these impacts can result in financial losses due to costs associated with incident response, legal fees, regulatory fines, and potential loss of business.

Key Takeaways

Sensitive data exposure occurs when an application fails to properly protect confidential information.
It was named as one of the OWAS Top 10 in 2017, but was renamed to its root cause, Cryptographic Failures, in 2021.
It has 29 mapped CWEs, including CWE-261 (Weak Encoding for Password), CWE-296 (Improper Following of a Certificate’s Chain of Trust), and CWE-310 (Cryptographic Issues).
Having any of these CWEs in your infrastructure can significantly expand your attack surface.
Among its consequences are identity theft, fraud, reputational damage, operational disruption, and regulatory fines.