DerScanner
Home / Vulnerability Database / C-sharp : Privacy violation (Unmanaged memory usage)
C#

C-sharp : Privacy violation (Unmanaged memory usage)

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic Failures
OWASP MASVS
V2: 2.10.(L2/L2+R)V7: 7.8.(L1/L2/L1+R/L2+R)
PCI DSS 4.0
3.3.1
HIPAA
§164.312 (a)(1)
CWE
CWE-244CWE-312CWE-359CWE-1032

Overview

The content of the String object can not be deleted from memory by the software. Valuable data leak is possible.

If valuable data (passwords, credit card numbers, etc.) is not deleted from memory immediately after use, leak is possible. String objects are immutable; their values can only be removed by the garbage collector. The garbage collector does not run until the virtual machine runs out of memory. Memory dump created in the case of process emergency stop may contain confidential information.

It is important to note that classes from System.Web.UI.WebControls are also affected by this vulnerability.

References

  1. OWASP Top 10 2013-A6-Sensitive Data Exposure
  2. CWE-359: Exposure of Private Information (‘Privacy Violation’)
  3. OWASP Top 10 2017-A3-Sensitive Data Exposure
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
  5. CWE-244
  6. CWE-312
MEDIUM

DerScanner Severity Score

Do you want to fix C-sharp : Privacy violation (Unmanaged memory usage) in your application?

See also

C#

C-sharp : JWT: None Algorithm

C#

C-sharp : Insecure data transmission: Database

C#

C-sharp : Only one of method Equals() and GetHashCode() defined