KParuchuri169091 (Community Member) asked a question.
how to fix insertion of Sensitive Information Into Sent Data
Fix for Insertion of Sensitive Information Into Sent Data (CWE ID 201) ?
we are passing only what is required to call the api with clientId, client secret, grant Type and scope is being fetched from the azure keyvault.
var response = response = await _authHttpClient.PostAsync(oauth2Token, tokenRequest?.Content);
Not sure why veracode reported this as CWE ID 201 . please suggest what fix can be applied here .
.png){kind=logo}
Hello @KParuchuri169091 (Community Member),
Veracode Static Analysis reports CWE-201 when it detects that potentially sensitive data is sent out of the application. The concern is that the sent information could be confidential (like passwords or personal communications), or it might give adversaries intelligence for later attacks.
To address this finding, we recommend reviewing whether the transfer of sensitive data is intentional and compliant with your application security policy. If it is unintentional or breaches your application security policy, stop transmitting that specific data. Otherwise, we recommend proposing a mitigation and consulting with your security team. For guidance on proposing mitigations, please refer to this documentation.
Kind regards,
Duncan