cve.bz

CWE-209: Generation of Error Message Containing Sensitive Information, page 10

Filter

The product generates an error message that includes sensitive information about its environment, users, or associated data.

What the weakness is: CWE-209 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions

Related attack patterns (CAPEC): 4
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-54 Query System for Information Likelihood: High · Severity: Low
  • CAPEC-215 Fuzzing for application mapping Likelihood: High · Severity: Low
  • CAPEC-463 Padding Oracle Crypto Attack Severity: High

The attack patterns MITRE's CAPEC relates to CWE-209, as MITRE names them. Credits.

Ask an AI about CWE-209

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-209: Generation of Error Message Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/209.html and https://cve.bz/cve/cwe/209?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2022-2062EPSS 1.5%

    Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.

  2. 7.5CVE-2022-31023EPSS 1.3%

    Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, i…

  3. 5.3CVE-2022-26973EPSS 0.8%

    Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path detai…

  4. 4.3CVE-2022-24906EPSS 1.1%

    Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1…

  5. 4.3CVE-2022-26070EPSS 0.6%

    When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1…

  6. 7.5CVE-2021-39023EPSS 0.9%

    IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against …

  7. 4.3CVE-2021-43206EPSS 0.8%

    A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0.0 through 7.0.1, 2.0.x allows malicious webservers to retrieve a web proxy's cl…

  8. 7.5CVE-2022-29266EPSS 8.1%

    In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

  9. 6.5CVE-2021-39033EPSS 1.0%

    IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informa…

  10. 6.5CVE-2022-1120EPSS 1.2%

    Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.

  11. 7.5CVE-2021-32937EPSS 1.1%

    An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the …

  12. 5.3CVE-2022-23794EPSS 0.9%

    An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.

  13. 4.9CVE-2022-24731EPSS 1.0%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read…

  14. 5.3CVE-2021-35251EPSS 0.9%

    Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation.

  15. 5.3CVE-2021-46353EPSS 2.2%

    An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a specially crafted HTTP request and gain knowledge of different absolute paths that are being used by the we…

  16. 5.5CVE-2021-3620EPSS 0.4%

    A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confi…

  17. 5.5CVE-2022-0563EPSS 0.4%

    A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specifi…

  18. 7.5CVE-2022-0660ExploitEPSS 6.9%

    Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

  19. 5.3CVE-2022-0622EPSS 1.0%

    Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.

  20. 8.8CVE-2021-26726EPSS 1.1%

    A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 20…

  21. 6.5CVE-2022-0504EPSS 1.2%

    Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

  22. 5.3CVE-2021-40338EPSS 0.7%

    Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue …

  23. 7.8CVE-2022-22162EPSS 0.2%

    A Generation of Error Message Containing Sensitive Information vulnerability in the CLI of Juniper Networks Junos OS allows a locally authenticated attacker with low privileges to elevate these to the level of any other user logged in via …

  24. 2.7CVE-2021-38894EPSS 1.0%

    IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against …

  25. 5.3CVE-2022-0083EPSS 0.9%

    livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information

  26. 5.3CVE-2022-0079EPSS 1.0%

    showdoc is vulnerable to Generation of Error Message Containing Sensitive Information

  27. 5.3CVE-2021-4177EPSS 1.0%

    livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information

  28. 5.3CVE-2021-44155EPSS 1.9%

    An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows a…

  29. 6.5CVE-2021-43542EPSS 1.8%

    Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

  30. 5.3CVE-2021-38980EPSS 1.2%

    IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This …

  31. 5.3CVE-2021-38981EPSS 1.4%

    IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks a…

  32. 4.3CVE-2021-40126EPSS 0.9%

    A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure. This vulnerability is due to an overly descriptive error…

  33. 5.3CVE-2021-35060EPSS 0.8%

    /way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.

  34. 4.3CVE-2021-20552EPSS 1.0%

    IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t…

  35. 4.3CVE-2021-20485EPSS 1.0%

    IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against t…

  36. 2.7CVE-2021-20377EPSS 1.0%

    IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force …

  37. 4.3CVE-2020-4941EPSS 0.7%

    IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 191941.

  38. 5.5CVE-2021-1546EPSS 0.2%

    A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit t…

  39. 4.3CVE-2021-20508EPSS 1.0%

    IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. I…

  40. 6.5CVE-2021-39458EPSS 1.2%

    Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environmen…

  41. 5.3CVE-2021-32766EPSS 1.3%

    Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public l…

  42. 5.3CVE-2021-35947EPSS 1.3%

    The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL.

  43. 7.5CVE-2021-25958EPSS 2.6%

    In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long p…

  44. 4.3CVE-2021-22249EPSS 1.0%

    A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group

  45. 7.5CVE-2017-16629EPSS 1.2%

    In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identi…

  46. 4.3CVE-2021-29784EPSS 1.0%

    IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. …

  47. 5.3CVE-2021-29767EPSS 1.3%

    IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks a…

  48. 5.3CVE-2021-29766EPSS 1.3%

    IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in …

  49. 5.3CVE-2021-20430EPSS 1.3%

    IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in …

  50. 5.3CVE-2021-25809EPSS 0.9%

    UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php.