CWEweakness

CWE-210 Self-generated Error Message Containing Sensitive Information

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Common consequences

• Confidentiality: Read Application Data

Potential mitigations

• [Implementation, Build and Compilation] Debugging information should not make its way into a production release. • [Implementation, Build and Compilation] Debugging information should not make its way into a production release.

Observed examples

• CVE-2005-1745: Infoleak of sensitive information in error message (physical access required).

Related

Observed example · CVE (1)

  • CVE-2005-1745 The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login… vulnerability

Child of · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

Referenced by CVE · weakness (4)

  • CVE-2026-73844 CKAN MCP Server is a tool for querying CKAN open data portals. vulnerability
  • CVE-2023-41027 Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an… vulnerability
  • CVE-2021-40126 A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration… vulnerability
  • CVE-2018-19947 The vulnerability have been reported to affect earlier versions of Helpdesk. vulnerability