The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Primary

Implementation
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Operation
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Confidentiality
Read Files or Directories

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Architecture and Design
Operation
System Configuration
Do not expose file and directory information to the user.

In the following code snippet, a user's full name and credit card number are written to a log file.

logger.info("Username: " + usernme + ", CCN: " + ccn);

CVE-2018-1999036
SSH password for private key stored in build log
https://www.cve.org/CVERecord?id=CVE-2018-1999036

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Depending on usage, this could be a weakness or a category. Further study of all its children is needed, and the entire sub-tree may need to be clarified. The current organization is based primarily on the exposure of sensitive information as a consequence, instead of as a primary weakness.
There is a close relationship with CWE-552, which is more focused on weaknesses. As a result, it may be more appropriate to convert CWE-538 to a category.

CWE Community
2006-07-19
Draft 3
2006-07-19
Submitted by members of the CWE community to extend early CWE versions

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Type

CWE Content Team
MITRE
2009-12-28
updated Description, Maintenance_Notes, Name

Veracode
2010-09-09
Suggested OWASP Top Ten mapping

CWE Content Team
MITRE
2010-09-27
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-02-21
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Description, Name, Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

File and Directory Information Leaks
File and Directory Information Exposure