CWE-209: Generation of Error Message Containing Sensitive Information, page 8
Filter
The product generates an error message that includes sensitive information about its environment, users, or associated data.
What the weakness is: CWE-209 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions
Related attack patterns (CAPEC): 4
- CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
- CAPEC-54 Query System for Information Likelihood: High · Severity: Low
- CAPEC-215 Fuzzing for application mapping Likelihood: High · Severity: Low
- CAPEC-463 Padding Oracle Crypto Attack Severity: High
The attack patterns MITRE's CAPEC relates to CWE-209, as MITRE names them. Credits.
Ask an AI about CWE-209
Show the prompt
Explain CWE-209: Generation of Error Message Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/209.html and https://cve.bz/cve/cwe/209?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2024-21313EPSS 1.5%
Windows TCP/IP Information Disclosure Vulnerability
- 5.7CVE-2023-6944EPSS 0.6%
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display …
- 5.3CVE-2023-50348EPSS 0.3%
HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker with insight into the application, system, etc.
- 6.5CVE-2023-45701EPSS 0.5%
HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- 5.3CVE-2023-27319EPSS 0.4%
ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API.
- 5.3CVE-2023-47703EPSS 0.8%
IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against th…
- 5.3CVE-2023-42013EPSS 0.7%
IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informati…
- 5.3CVE-2023-6839EPSS 0.5%
Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.
- 4.3CVE-2023-48393EPSS 0.6%
Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system information from error message.
- 4.3CVE-2023-49878EPSS 0.7%
IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be us…
- 5.3CVE-2023-31048EPSS 0.8%
The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.
- 4.3CVE-2023-49080EPSS 0.8%
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user includ…
- 5.3CVE-2023-43021EPSS 0.7%
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. …
- 5.3CVE-2023-47636EPSS 0.7%
The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using th…
- 5.3CVE-2023-5514EPSS 0.4%
The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local file system structure.
- 7.5CVE-2023-46240EPSS 0.8%
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be l…
- 5.3CVE-2022-43891EPSS 0.7%
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the…
- 7.5CVE-2023-4457EPSS 0.5%
Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitiz…
- 4.3CVE-2023-42475EPSS 0.5%
The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.
- 5.5CVE-2023-0833EPSS 0.4%
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attack…
- 8.8CVE-2023-41027EPSS 0.9%
Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an authenticated attacker to leak the password for the administrative account via requests to the vulne…
- 4.0CVE-2023-40725EPSS 0.2%
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate …
- 5.3CVE-2023-37489EPSS 0.5%
Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidential…
- 4.3CVE-2023-39264EPSS 1.1%
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- 4.3CVE-2023-35124EPSS 0.6%
An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensit…
- 7.5CVE-2023-33835EPSS 0.7%
IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 256015.
- 5.3CVE-2023-33834EPSS 0.7%
IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system. IBM X-force ID: 256014.
- 9.8CVE-2023-40767EPSS 0.9%
User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attac…
- 9.8CVE-2023-40766EPSS 0.9%
User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force atta…
- 9.8CVE-2023-40765EPSS 0.9%
User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack…
- 9.8CVE-2023-40764EPSS 0.9%
User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack wit…
- 9.8CVE-2023-40763EPSS 1.1%
User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack wi…
- 9.8CVE-2023-40762EPSS 0.9%
User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack wit…
- 9.8CVE-2023-40761EPSS 0.9%
User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack w…
- 9.8CVE-2023-40760EPSS 0.9%
User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack …
- 9.8CVE-2023-40759EPSS 0.9%
User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force at…
- 9.8CVE-2023-40758EPSS 0.9%
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with …
- 9.8CVE-2023-40757EPSS 0.9%
User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack w…
- 5.3CVE-2023-26272EPSS 0.5%
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could…
- 5.3CVE-2023-32755EPSS 0.6%
e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information from error message by sending a crafted command.
- 7.5CVE-2023-40171EPSS 0.9%
Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an erro…
- 5.3CVE-2023-35009EPSS 1.0%
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-For…
- 4.3CVE-2023-1210EPSS 0.6%
An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an err…
- 5.5CVE-2023-31429EPSS 0.2%
Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgdisable and s…
- 5.3CVE-2020-4868EPSS 0.7%
IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-F…
- 5.5CVE-2023-20593EPSS 5.1%
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
- 7.5CVE-2023-25948EPSS 0.6%
Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
- 5.3CVE-2023-3362EPSS 0.5%
An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.
- 7.5CVE-2023-37260EPSS 1.0%
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file …
- 7.5CVE-2023-37306EPSS 0.5%
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.