CWE-210: Self-generated Error Message Containing Sensitive Information
Description
The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Confidentiality
Read Application Data
Potential mitigations
- ImplementationBuild and CompilationCompilation or Build Hardening
Debugging information should not make its way into a production release.
- ImplementationBuild and CompilationEnvironment Hardening
Debugging information should not make its way into a production release.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.