이름: Invocation of Process Using Visible Sensitive Information

A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

일반 정보

배경 세부 정보

취약점 도입 방식

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Confidentiality	Read Application Data 참고: When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.

관찰된 예시

참고 자료	설명
CVE-2023-38994	IAM product includes LDAP password in a process call, allowing local users to obtain the password
CVE-2005-1387	password passed on command line
CVE-2005-2291	password passed on command line
CVE-2001-1565	username/password on command line allows local users to view via "ps" or other process listing programs
CVE-2004-1948	Username/password on command line allows local users to view via "ps" or other process listing programs.
CVE-1999-1270	PGP passphrase provided as command line argument.
CVE-2004-1058	Kernel race condition allows reading of environment variables of a process that is still spawning.
CVE-2021-32638	Code analysis product passes access tokens as a command-line parameter or through an environment variable, making them visible to other processes via the ps command.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

메모

Under-studied, especially environment variables.

제출

이름	조직	날짜	출시일	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

수정 사항

이름	조직	날짜	댓글
Sean Eidemiller	Cigital	2008-07-01 +00:00	added/updated demonstrative examples
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2008-10-14 +00:00	updated Description, Other_Notes
CWE Content Team	MITRE	2009-10-29 +00:00	updated Other_Notes
CWE Content Team	MITRE	2011-03-29 +00:00	updated Name
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Demonstrative_Examples, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Modes_of_Introduction, Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Description, Name, Relationships, Type
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description, Observed_Examples, Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated Functional_Areas
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-04-30 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2026-10-28 +00:00	updated Background_Details, Common_Consequences, Description

CWE-214 상세 정보

CWE-214