CWE-210
Self-generated Error Message Containing Sensitive Information
2006-07-19
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Self-generated Error Message Containing Sensitive Information
The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
一般情報
導入モード
Architecture and DesignImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Confidentiality | Read Application Data |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2005-1745 | Infoleak of sensitive information in error message (physical access required). |
潜在的な緩和策
Phases : Implementation // Build and CompilationDebugging information should not make its way into a production release.
Phases : Implementation // Build and Compilation
Debugging information should not make its way into a production release.
脆弱性マッピングノート
理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
参考文献
REF-44
24 Deadly Sins of Software SecurityMichael Howard, David LeBlanc, John Viega.
REF-62
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh.
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Name, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Name, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Other_Notes | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Functional_Areas, Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Name, Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities |
