---
title: "Base64 Disclosure"
description: "HawkScan test information for plugin 10094: Base64 Disclosure"
url: https://docs.stackhawk.com/vulnerabilities/10094/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# Base64 Disclosure

###### Reference

- **Plugin ID:** 10094
- [**CWE:** 200](https://cwe.mitre.org/data/definitions/200.html)
- **WASC:** 13
- **Risk:** Unknown
- **Type:** Passive
- **Category:** Information Disclosure

### Remediation

1. **Review exposed data**: Manually examine all Base64 encoded strings to determine if they contain sensitive information.
2. **Remove sensitive encoding**: Eliminate any Base64 encoded sensitive data from responses.
3. **Implement access controls**: Ensure that any legitimate Base64 encoded data is properly protected with authentication and authorization.
4. **Regular security reviews**: Periodically audit responses for unintended data exposure.

### About

Base64 Disclosure occurs when applications include Base64 encoded data in HTTP responses that may contain sensitive information. While Base64 is encoding rather than encryption, it can obscure sensitive data that developers may not realize is being exposed to clients.

### Risks

**Medium** Base64 encoded data may contain sensitive information such as database connection strings, API keys, internal system details, or user data that could be exploited by attackers for further system compromise.