이름: Self-generated Error Message Containing Sensitive Information

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

일반 정보

취약점 도입 방식

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Confidentiality	Read Application Data

관찰된 예시

참고 자료	설명
CVE-2005-1745	Infoleak of sensitive information in error message (physical access required).

잠재적 완화 방법

Phases : Implementation // Build and Compilation
Debugging information should not make its way into a production release.
Phases : Implementation // Build and Compilation
Debugging information should not make its way into a production release.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

참고 자료

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

제출

이름	조직	날짜	출시일	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

수정 사항

이름	조직	날짜	댓글
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2009-12-28 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2010-06-21 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2011-03-29 +00:00	updated Name, Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated References, Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Name, Potential_Mitigations
CWE Content Team	MITRE	2014-06-23 +00:00	updated Other_Notes
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Functional_Areas, Modes_of_Introduction, Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Name, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities

CWE-210 상세 정보

CWE-210