cve.bz

CWE-209: Generation of Error Message Containing Sensitive Information, page 11

Filter

The product generates an error message that includes sensitive information about its environment, users, or associated data.

What the weakness is: CWE-209 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions

Related attack patterns (CAPEC): 4
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-54 Query System for Information Likelihood: High · Severity: Low
  • CAPEC-215 Fuzzing for application mapping Likelihood: High · Severity: Low
  • CAPEC-463 Padding Oracle Crypto Attack Severity: High

The attack patterns MITRE's CAPEC relates to CWE-209, as MITRE names them. Credits.

Ask an AI about CWE-209

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-209: Generation of Error Message Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/209.html and https://cve.bz/cve/cwe/209?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2021-32775EPSS 0.8%

    Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0.

  2. 6.5CVE-2021-22145ExploitEPSS 76%

    A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message r…

  3. 2.7CVE-2021-20523EPSS 1.0%

    IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system…

  4. 2.7CVE-2021-20499EPSS 1.0%

    IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system…

  5. 4.3CVE-2021-20424EPSS 1.0%

    IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Fo…

  6. 5.3CVE-2021-33711EPSS 0.8%

    A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application all…

  7. 5.3CVE-2021-32734EPSS 1.4%

    Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could …

  8. 4.3CVE-2021-20417EPSS 0.6%

    IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…

  9. 4.3CVE-2021-20413EPSS 0.8%

    IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…

  10. 5.3CVE-2021-32712EPSS 1.1%

    Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Aut…

  11. 5.3CVE-2020-20470EPSS 0.9%

    White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability.

  12. 5.3CVE-2021-31159ExploitEPSS 18%

    Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

  13. 6.5CVE-2021-26997EPSS 1.1%

    E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploited could allow a remote attacker to discover information via error messaging which may aid in craft…

  14. 5.3CVE-2021-30357EPSS 23%

    SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.

  15. 6.5CVE-2021-20371EPSS 1.2%

    IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Fo…

  16. 7.5CVE-2021-22885EPSS 4.1%

    A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

  17. 5.3CVE-2021-20428EPSS 1.3%

    IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force …

  18. 7.5CVE-2021-29688EPSS 2.0%

    IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM…

  19. 5.3CVE-2021-29682EPSS 1.3%

    IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM…

  20. 5.3CVE-2021-29040EPSS 1.1%

    The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the conten…

  21. 7.5CVE-2021-20393EPSS 1.4%

    IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks agai…

  22. 6.5CVE-2020-23995EPSS 1.5%

    An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.

  23. 5.5CVE-2021-23135EPSS 0.2%

    Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versi…

  24. 5.3CVE-2020-19275EPSS 1.2%

    An Information Disclosure vulnerability exists in dhcms 2017-09-18 when entering invalid characters after the normal interface, which causes an error that will leak the physical path.

  25. 4.3CVE-2021-31341EPSS 0.7%

    Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).

  26. 4.3CVE-2021-31339EPSS 0.8%

    A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an exception that could expose information about the Application-Server and the used XML-Framework.

  27. 4.3CVE-2020-4536EPSS 1.0%

    IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Fo…

  28. 6.5CVE-2021-21421EPSS 1.1%

    node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.

  29. 2.6CVE-2021-21416EPSS 0.4%

    django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base use…

  30. 4.3CVE-2021-3393EPSS 1.2%

    An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, m…

  31. 5.3CVE-2021-20289EPSS 1.4%

    A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the …

  32. 4.3CVE-2021-22169EPSS 0.8%

    An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.

  33. 3.5CVE-2021-22193EPSS 1.0%

    An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.

  34. 3.5CVE-2019-18947EPSS 0.3%

    Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure.

  35. 6.5CVE-2021-23973EPSS 1.4%

    When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird …

  36. 4.3CVE-2021-23968EPSS 1.3%

    If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contai…

  37. 2.7CVE-2020-1717EPSS 0.8%

    A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.

  38. 2.7CVE-2021-20402EPSS 1.0%

    IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks again…

  39. 5.3CVE-2020-4628EPSS 1.3%

    IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks again…

  40. 5.3CVE-2020-4600EPSS 1.3%

    IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…

  41. 5.3CVE-2020-4599EPSS 1.3%

    IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…

  42. 4.3CVE-2020-15219EPSS 0.7%

    Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.

  43. 4.3CVE-2020-4544EPSS 1.0%

    IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Forc…

  44. 4.3CVE-2020-4487EPSS 1.0%

    IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Forc…

  45. 5.3CVE-2020-4897EPSS 1.6%

    IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information …

  46. 5.3CVE-2020-4761EPSS 1.3%

    IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. …

  47. 2.3CVE-2020-2505EPSS 0.3%

    If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

  48. 4.9CVE-2020-4842EPSS 1.1%

    IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…

  49. 2.7CVE-2020-4846EPSS 1.0%

    IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against th…

  50. 5.3CVE-2020-35177EPSS 1.3%

    HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.