I was running Wireshark while using a website, when I noticed a session cookie storing in cleartext the email address, my first name, my gender and the date of birth I set during the signup process.
In my opinion, it is a vulnerability because it allows an attacker who is sniffing the traffic to retrieve personal data that are useless to manage the session (why do they even need to store my date of birth in a cookie?) and that, in any case, shouldn't be sent in cleartext.
Before sending a report to the website, I would like to be sure about the proper term for this vulnerability. I browsed through the CWE website (http://cwe.mitre.org/), and I think this should either be an example of CWE-315: Cleartext Storage of Sensitive Information in a Cookie or a case of CWE - 319 : Cleartext Transmission of Sensitive Information.
My two (strictly related) questions are:
- are the information listed above (date of birth, gender, first name, email address) considered sensitive information in the sense of the CWE definitions? The server is located in a EU country, if that helps;
- If they are indeed sensitive data, is this an example of CWE-315, CWE-319, both, or something else entirely?