cve.bz

CWE-209: Generation of Error Message Containing Sensitive Information, page 12

Filter

The product generates an error message that includes sensitive information about its environment, users, or associated data.

What the weakness is: CWE-209 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions

Related attack patterns (CAPEC): 4
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-54 Query System for Information Likelihood: High · Severity: Low
  • CAPEC-215 Fuzzing for application mapping Likelihood: High · Severity: Low
  • CAPEC-463 Padding Oracle Crypto Attack Severity: High

The attack patterns MITRE's CAPEC relates to CWE-209, as MITRE names them. Credits.

Ask an AI about CWE-209

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-209: Generation of Error Message Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/209.html and https://cve.bz/cve/cwe/209?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2020-4907EPSS 1.3%

    IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used …

  2. 3.8CVE-2020-16128EPSS 0.3%

    The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affected versions prior to 1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+b…

  3. 5.3CVE-2020-25640EPSS 1.3%

    A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

  4. 3.3CVE-2020-16121EPSS 0.5%

    PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.

  5. 4.3CVE-2020-4483EPSS 1.0%

    IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further a…

  6. 7.5CVE-2020-4584EPSS 1.0%

    IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184…

  7. 4.4CVE-2020-27015EPSS 0.9%

    Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability t…

  8. 5.3CVE-2019-4547EPSS 1.1%

    IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 165949.

  9. 4.3CVE-2020-15794EPSS 0.8%

    A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional informatio…

  10. 6.0CVE-2020-25778EPSS 0.6%

    Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-pr…

  11. 6.5CVE-2020-15666EPSS 1.2%

    When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/…

  12. 3.3CVE-2020-4629EPSS 0.3%

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the…

  13. 5.3CVE-2020-25633EPSS 1.2%

    A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call…

  14. 7.5CVE-2020-24925EPSS 1.0%

    A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker i…

  15. 6.5CVE-2018-19947EPSS 0.8%

    The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.

  16. 5.3CVE-2020-4166EPSS 1.3%

    IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IB…

  17. 2.7CVE-2019-4699EPSS 0.5%

    IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931.

  18. 5.3CVE-2020-15132EPSS 1.1%

    In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is …

  19. 5.8CVE-2020-14337EPSS 1.5%

    A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames…

  20. 5.3CVE-2020-8213EPSS 1.1%

    An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing.

  21. 7.7CVE-2020-15125EPSS 1.5%

    In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the A…

  22. 5.3CVE-2020-4572EPSS 1.7%

    IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the …

  23. 7.5CVE-2020-13997EPSS 1.5%

    In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.

  24. 4.3CVE-2020-4319EPSS 0.7%

    IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub …

  25. 6.5CVE-2019-11252EPSS 1.0%

    The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

  26. 6.5CVE-2020-6511EPSS 1.7%

    Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

  27. 7.5CVE-2020-15478ExploitEPSS 4.7%

    The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.

  28. 5.3CVE-2020-4341EPSS 1.4%

    IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…

  29. 5.3CVE-2020-4327EPSS 1.1%

    IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…

  30. 5.3CVE-2020-4532EPSS 1.3%

    IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is …

  31. 6.5CVE-2020-6503EPSS 0.8%

    Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

  32. 2.7CVE-2020-4248EPSS 1.0%

    IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks aga…

  33. 4.3CVE-2020-4357EPSS 1.0%

    IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…

  34. 5.3CVE-2019-18865EPSS 1.1%

    Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames.

  35. 5.5CVE-2019-12864EPSS 0.5%

    SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via …

  36. 4.3CVE-2019-4729EPSS 1.6%

    IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM …

  37. 6.5CVE-2020-4085EPSS 0.8%

    "HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."

  38. 5.3CVE-2020-11883EPSS 15%

    In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module…

  39. 7.5CVE-2020-4277EPSS 1.4%

    IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993.

  40. 4.3CVE-2019-4593EPSS 0.8%

    IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.

  41. 4.3CVE-2020-6438EPSS 1.3%

    Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Ch…

  42. 2.7CVE-2020-4164EPSS 1.0%

    IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400.

  43. 4.3CVE-2019-4601EPSS 1.0%

    IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.

  44. 7.5CVE-2020-11594EPSS 1.2%

    An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path.

  45. 5.3CVE-2020-4239EPSS 1.8%

    IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against …

  46. 5.4CVE-2020-5274EPSS 1.2%

    In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorH…

  47. 5.5CVE-2019-4619EPSS 0.3%

    IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.

  48. 7.5CVE-2019-12446EPSS 1.2%

    An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.

  49. 5.3CVE-2020-10097EPSS 0.9%

    An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabi…

  50. 5.3CVE-2019-19993EPSS 1.2%

    An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages …