1244
}
The error message that is created includes information about the database query that may contain
sensitive information about the database or query logic. In this case, the error message will expose
the table name and column names used in the database. This data could be used to simplify other
attacks, such as SQL injection (CWE-89) to directly access the database.
Observed Examples
Reference Description
CVE-2017-9615 verbose logging stores admin credentials in a world-readable log file
https://www.cve.org/CVERecord?id=CVE-2017-9615
CVE-2018-1999036SSH password for private key stored in build log
https://www.cve.org/CVERecord?id=CVE-2018-1999036
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 857 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 14 - Input Output (FIO)
844 2368
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1147 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 13. Input Output (FIO)
1133 2450
MemberOf 1355 OWASP Top Ten 2021 Category A09:2021 - Security
Logging and Monitoring Failures
1344 2496
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO13-J Do not log sensitive information outside
a trust boundary
Software Fault Patterns SFP23 Exposed Data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
215 Fuzzing for application mapping
CWE-535: Exposure of Information Through Shell Error Message
Weakness ID : 535
Structure : Simple
Abstraction : Variant
Description
A command shell error message indicates that there exists an unhandled exception in the web
application code. In many cases, an attacker can leverage the conditions that cause these errors in
order to gain unauthorized access to the system.
Relationships
CWE Version 4.14
CWE-536: Servlet Runtime Error Message Containing Sensitive Information
CWE-536: Servlet Runtime Error Message Containing Sensitive Information