CWEweakness
CWE-537 Java Runtime Error Message Containing Sensitive Information
- Abstraction
- Variant
- Structure
- Simple
- Status
- Incomplete
- Languages
- Java
- CWE version
- 5.0
Description
In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.
Common consequences
• Confidentiality: Read Application Data
Potential mitigations
• [Implementation] Do not expose sensitive error information to the user.
Related
Child of · CWE (1)
- CWE-211 Externally-Generated Error Message Containing Sensitive Information weakness
Referenced by OWASP · mapped cwe (1)
- A05:2021 Security Misconfiguration Top 10 2021