COMMON WEAKNESS ENUMERATIONIncomplete

CWE-550

Server-generated Error Message Containing Sensitive Information

Certain conditions, such as network failure, will cause a server error message to be displayed.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

Certain conditions, such as network failure, will cause a server error message to be displayed.

Extended description

While error messages in and of themselves are not dangerous, per se, it is what an attacker can glean from them that might cause eventual problems.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Risk

What does successful exploitation lead to?

Read Application Data

Affected security scopes: Confidentiality

Defence

How is it prevented and fixed?

Architecture and Design · System Configuration

Defence to apply across several lifecycle phases

Detail
Recommendations include designing and adding consistent error handling mechanisms which are capable of handling any user input to your web application, providing meaningful detail to end-users, and preventing error messages that might provide information useful to an attacker from being displayed.