Debug Messages Revealing Unnecessary Information
CWE-1295
The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
Debug messages are messages that help troubleshoot an issue by revealing the internal state of the system. For example, debug data in design can be exposed through internal memory array dumps or boot logs through interfaces like UART via TAP commands, scan chain, etc. Thus, the more information contained in a debug message, the easier it is to debug. However, there is also the risk of revealing information that could help an attacker either decipher a vulnerability, and/or gain a better understanding of the system. Thus, this extra information could lower the security by obscurity factor. While security by obscurity alone is insufficient, it can help as a part of Defense-in-depth.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Implementation: Ensure that a debug message does not reveal any unnecessary information during the debug process for the intended response.
Latest Debug Messages Revealing Unnecessary Information vulnerabilities
- 7.5 High severity
Apache JSPWiki: Debug Messages Revealing Unnecessary Information
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
- 9.3 Critical severity
backpropagate: Improperly Implemented Security Check for Standard
Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run
- 7.5 High severity
GTM Kit: Debug Messages Revealing Unnecessary Information
Debug Messages Revealing Unnecessary Information vulnerability in TLA Media GTM Kit gtm-kit allows Retrieve Embedded Sensitive Data.This issue affects GTM Kit: from n/a through <= 2.4.0.
- 7.5 High severity
Apache Airflow: Debug Messages Revealing Unnecessary Information
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users
- 8.8 High severity
ai-client-html: Debug Messages Revealing Unnecessary Information
ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
- 7.5 High severity
C300: Debug Messages Revealing Unnecessary Information
C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendation
- 7.5 High severity
WebAccess: Debug Messages Revealing Unnecessary Information
Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials.