CWE-598

Use of GET Request Method With Sensitive Query Strings

Medium

Description

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Potential Impact

Confidentiality: Read Application Data

How to Fix

Implementation

When sensitive information is sent, use the POST method (e.g. registration form).

Detection Methods

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-598 vulnerabilities in your codebase.

Get Security Assessment