CAS-003 · Question #844
A developer implements the following code snippet: Which of the following vulnerabilities does this code snippet resolve?
The correct answer is D. Information leakage. The code snippet addresses information leakage by controlling what sensitive internal details are exposed in application output, such as error messages, stack traces, or internal data returned to users.
Question
A developer implements the following code snippet:
Which of the following vulnerabilities does this code snippet resolve?
Options
- ASQL injection
- BBuffer overflow
- CMissing session limit
- DInformation leakage
How the community answered
(17 responses)- B6% (1)
- C12% (2)
- D82% (14)
Why each option
The code snippet addresses information leakage by controlling what sensitive internal details are exposed in application output, such as error messages, stack traces, or internal data returned to users.
SQL injection is prevented through parameterized queries or prepared statements that separate code from data, not through output sanitization or error message control.
Buffer overflow vulnerabilities are mitigated by enforcing input length bounds and using memory-safe functions, not by controlling what the application returns as output.
Missing session limits are addressed through session timeout policies and concurrent session controls, which are unrelated to the output filtering shown in this snippet.
Information leakage occurs when an application unintentionally reveals sensitive internals - such as database error details, software version strings, internal file paths, or stack traces - to users or potential attackers. The code snippet implements output control that suppresses or sanitizes such details before they are returned in a response, directly resolving the vulnerability without requiring changes to input handling or session management.
Concept tested: Preventing information leakage through error output control
Source: https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure
Topics
Community Discussion
No community discussion yet for this question.