Generation of Error Message Containing Sensitive Information
CWE-209
The product generates an error message that includes sensitive information about its environment, users, or associated data.
We track 89 vulnerabilities of this type. 98% are rated high or critical, and the average CVSS score is 8.0. 3 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
- Implementation: Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
- Implementation Build and Compilation: Debugging information should not make its way into a production release.
- Implementation Build and Compilation: Debugging information should not make its way into a production release.
- System Configuration: Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Latest Generation of Error Message Containing Sensitive Information vulnerabilities
- 7.5 High severity
Apache Airflow AWS Provider: Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- 7.5 High severity
Pghero: Generation of Error Message Containing Sensitive Information
PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the data
- 7.5 High severity
InfoSphere Information Server: Generation of Error Message Containing Sensitive Information
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: 231
- 7.5 High severity
Wyse Management Suite: Generation of Error Message Containing Sensitive Information
Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit this vulnerability, leading to the disclosure of certain sensitive information. The attacker may be able to use the exposed
- 9.1 Critical severity
Valinor: Generation of Error Message Containing Sensitive Information
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessage()` when it should not have permission to do so. This is a problem with cases such as an SQL except
- 7.5 High severity
playframework: Generation of Error Message Containing Sensitive Information
Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception
- 7.5 High severity
Apache APISIX: Generation of Error Message Containing Sensitive Information
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.
- 7.8 High severity
Junos OS: Generation of Error Message Containing Sensitive Information
A Generation of Error Message Containing Sensitive Information vulnerability in the CLI of Juniper Networks Junos OS allows a locally authenticated attacker with low privileges to elevate these to the level of any other user logged in via J-Web at this time, p
- 4.3 Medium severity
Microsoft Internet Explorer Information Disclosure Exploited
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a r