📋 What Is It?
Sensitive Data Exposure - Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII, enabling attackers to steal or modify such data.
#3
OWASP Rank 2017
4%
Apps Tested
125K
Occurrences
⚠️ Common Exploits
- Man-in-the-Middle: Intercept unencrypted data
- Database Theft: Extract unencrypted database
- Weak Encryption: Break weak algorithms
- Missing HTTPS: Capture data in transit
- Backup Exposure: Access unprotected backups
🔴 Attack Flow
1. Attacker intercepts network traffic
↓
2. Identifies unencrypted sensitive data
↓
3. Captures credentials or personal information
↓
4. Exploits weak or missing encryption
↓
5. BREACH: Sensitive data stolen!
↓
2. Identifies unencrypted sensitive data
↓
3. Captures credentials or personal information
↓
4. Exploits weak or missing encryption
↓
5. BREACH: Sensitive data stolen!
✓ Prevention Checklist
- Encrypt all sensitive data at rest and in transit
- Use TLS 1.2+ for all connections
- Implement proper key management
- Disable caching for sensitive data
- Use strong encryption algorithms (AES-256)
📌 Quick Reference
Risk Level: HIGH RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #3 in 2017