CWEweakness
CWE-756 Missing Custom Error Page
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not return custom error pages to the user, possibly exposing sensitive information.
Common consequences
• Confidentiality: Read Application Data — Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.
Observed examples
• CVE-2023-27998: analytics platform does not have a custom error page, allowing access to sensitive information
Related
Observed example · CVE (1)
- CVE-2023-27998 A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may… vulnerability
Can precede · CWE (1)
- CWE-209 Generation of Error Message Containing Sensitive Information weakness
Child of · CWE (1)
- CWE-755 Improper Handling of Exceptional Conditions weakness
Referenced by CVE · weakness (3)
- CVE-2023-27998 A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may… vulnerability
- CVE-2022-3175 Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2. vulnerability
- CVE-2018-8913 Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a… vulnerability
Referenced by CWE · child of (2)
Referenced by CWE · has member (1)
- CWE-884 CWE Cross-section view