534
Nature Type ID Name Page
CanFollow 756 Missing Custom Error Page 1579
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 200 Exposure of Sensitive Information to an Unauthorized Actor 504
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1015 Limit Access 2430
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 199 Information Management Errors 2312
MemberOf 389 Error Conditions, Return Values, Status Codes 2322
Weakness Ordinalities
Primary :
Resultant :
Applicable Platforms
Language : PHP (Prevalence = Often)
Language : Java (Prevalence = Often)
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Often this will either reveal sensitive information which may
be used for a later attack or private information stored in
the server.
Detection Methods
Manual Analysis
This weakness generally requires domain-specific interpretation using manual analysis.
However, the number of potential error conditions may be too large to cover completely within
limited time constraints.
Effectiveness = High
Automated Analysis
Automated methods may be able to detect certain idioms automatically, such as exposed stack
traces or pathnames, but violation of business rules or privacy requirements is not typically
feasible.
Effectiveness = Moderate
Automated Dynamic Analysis
This weakness can be detected using dynamic tools and techniques that interact with the
software using large test suites with many diverse inputs, such as fuzz testing (fuzzing),
robustness testing, and fault injection. The software's operation may slow down, but it should not
CWE Version 4.14
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-209: Generation of Error Message Containing Sensitive Information