539
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR01-J Do not allow exceptions to expose
sensitive information
Software Fault Patterns SFP23 Exposed Data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
7 Blind SQL Injection
54 Query System for Information
215 Fuzzing for application mapping
463 Padding Oracle Crypto Attack
References
[REF-174]Web Application Security Consortium. "Information Leakage". < http://
projects.webappsec.org/w/page/13246936/Information%20Leakage >.2023-04-07.
[REF-175]Brian Chess and Jacob West. "Secure Programming with Static Analysis". 2007.
Addison-Wesley.
[REF-176]Michael Howard and David LeBlanc. "Writing Secure Code". 1st Edition. 2001 November
3. Microsoft Press.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-179]Johannes Ullrich. "Top 25 Series - Rank 16 - Information Exposure Through an Error
Message". 2010 March 7. SANS Software Security Institute. < http://software-security.sans.org/
blog/2010/03/17/top-25-series-rank-16-information-exposure-through-an-error-message >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-210: Self-generated Error Message Containing Sensitive Information
Weakness ID : 210
Structure : Simple
Abstraction : Base
Description
The product identifies an error condition and creates its own diagnostic or error messages that
contain sensitive information.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 209 Generation of Error Message Containing Sensitive
Information