CWEweakness
CWE-550 Server-generated Error Message Containing Sensitive Information
- Abstraction
- Variant
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
Certain conditions, such as network failure, will cause a server error message to be displayed.
Common consequences
• Confidentiality: Read Application Data — An attacker could steal the sensitive information and/or use it to launch further attacks.
Potential mitigations
• [Architecture and Design, System Configuration] Recommendations include designing and adding consistent error handling mechanisms which are capable of handling any user input to your web application, providing meaningful detail to end-users, and preventing error messages that might provide information useful to an attacker from being displayed.
Related
Child of · CWE (1)
- CWE-209 Generation of Error Message Containing Sensitive Information weakness
Referenced by CVE · weakness (5)
- CVE-2026-101915 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. vulnerability
- CVE-2025-36419 IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. vulnerability
- CVE-2025-62168 Squid is a caching proxy for the Web. vulnerability
- CVE-2023-5617 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version… vulnerability
- CVE-2023-40726 A vulnerability has been identified in QMS Automotive (All versions < V12.39). vulnerability
Referenced by OWASP · mapped cwe (1)
- A10:2025 Mishandling of Exceptional Conditions Top 10 2025