The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Primary

The query string for the URL could be
saved in the browser's history, passed through Referers to
other web sites, stored in web logs, or otherwise recorded
in other sources.

Architecture and Design

Implementation

Confidentiality
Read Application Data

At a minimum, attackers can garner information from
query strings that can be utilized in escalating
their method of attack, such as information about
the internal workings of the application or
database column names. Successful exploitation of
query string parameter vulnerabilities could lead
to an attacker impersonating a legitimate user,
obtaining proprietary data, or simply executing
actions not intended by the application developers.

Examples of sensitive information may include
secrets such as session identifiers, passwords,
access tokens, or API keys; Personally Identifiable
Information (PII) such as email addresses or phone
numbers; records or logs of private activities;
communications that are expected to be private;
etc. Successful exploitation of query string
parameter vulnerabilities could lead to an attacker
impersonating a legitimate user, obtaining
proprietary data, or simply executing actions not
intended by the application developers.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Implementation
When sensitive information is sent, use the POST method (e.g. registration form).

CVE-2022-23546
A discussion platform leaks private information in GET requests.
https://www.cve.org/CVERecord?id=CVE-2022-23546

SFP23
Exposed Data

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Community
2006-12-15
Draft 5
2006-12-15
Submitted by members of the CWE community to extend early CWE versions

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes

CWE Content Team
MITRE
2009-03-10
updated Relationships

CWE Content Team
MITRE
2011-03-29
updated Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Other_Notes

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Description, Name, Potential_Mitigations, Relationships

CWE Content Team
MITRE
2021-07-20
updated Description

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Description, Diagram, Other_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Background_Details, Common_Consequences, Other_Notes, References, Relationships, Weakness_Ordinalities

Michal Biesiada
2025-10-05
4.19
2025-12-11
Suggested OWASP reference and clarifying sensitive information details, ultimately leading to an addition to the CWE glossary.

Information Leak Through GET Request
Information Leak Through Query Strings in GET Request
Information Exposure Through Query Strings in GET Request