CWE-210
Self-generated Error Message Containing Sensitive Information
2006-07-19
00h00 +00:00
00h00 +00:00
指定 CWE 通知
随时了解指定 CWE 的变更。
名称: Self-generated Error Message Containing Sensitive Information
The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
基本信息
引入方式
Architecture and DesignImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
适用平台
编程语言
类： Not Language-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Confidentiality | Read Application Data |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2005-1745 | Infoleak of sensitive information in error message (physical access required). |
潜在缓解措施
Phases : Implementation // Build and CompilationDebugging information should not make its way into a production release.
Phases : Implementation // Build and Compilation
Debugging information should not make its way into a production release.
漏洞映射说明
依据 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
参考资料
REF-44
24 Deadly Sins of Software SecurityMichael Howard, David LeBlanc, John Viega.
REF-62
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh.
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Name, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Name, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Other_Notes | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Functional_Areas, Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Name, Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities |
