CWE-598 — Use of HTTP Request With Sensitive Query String
CWE-598: Use of HTTP Request With Sensitive Query String
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Draft |
| Likelihood of exploit | — |
Description
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Common consequences
- Confidentiality: Read Application Data
Mitigations
Implementation — When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.
References
- CWE page: https://cwe.mitre.org/data/definitions/598.html
- CWE list: https://cwe.mitre.org/data/index.html