CWE - 209 : Information Exposure Through an Error Message
|
CWE Definition
|
http://cwe.mitre.org/data/definitions/209.html
|
|
Number of vulnerabilities:
|
0
|
|
Description
|
The software generates an error message that includes sensitive
information about its environment, users, or associated
data.The sensitive information may be valuable information on its own (such as
a password), or it may be useful for launching other, more deadly attacks.
If an attack fails, an attacker may use error information provided by the
server to launch another more focused attack. For example, an attempt to
exploit a path traversal weakness (CWE-22) might yield the full pathname of
the installed application. In turn, this could be used to select the proper
number of ".." sequences to navigate to the targeted file. An attack using
SQL injection (CWE-89) might not initially succeed, but an error message
could reveal the malformed query, which would expose query logic and
possibly even passwords or other sensitive information used within the
query. |
|
Background Details
|
|
|
Other Notes
|
|
|
|
Warning! CWE definitions are provided as a quick reference. They are
not complete and may not be up to date!
You must visit
http://cwe.mitre.org/ for a complete list of CWE entries
and for more details.
