CWE-209 574 CVEs MITRE definition ↗

CWE-209: Generation of Error Message Containing Sensitive Information

Overview

CWE-209 (Generation of Error Message Containing Sensitive Information) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Applicable platforms

Kind Name Class Prevalence OS / CPE
language PHP Often
language Java Often
language Not Language-Specific Undetermined
technology Not Technology-Specific Undetermined

Related CVEs in this database

These CVEs are mapped to this weakness in this database and kept for traceability and search.

CVE Published Summary
CVE-2026-13182 2026-07-22 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protec…
CVE-2026-64627 2026-07-21 Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPu…
CVE-2026-63748 2026-07-20 SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through erro…
CVE-2026-8861 2026-07-17 IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks…
CVE-2024-23575 2026-07-17 HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error me…
CVE-2026-56139 2026-07-06 Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls wha…
CVE-2026-49365 2026-07-06 Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exposes a muteException option that controls…
CVE-2026-53906 2026-07-01 MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrar…
CVE-2026-56331 2026-06-30 Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is invalid. Attackers can tr…
CVE-2025-36328 2026-06-30 IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This informa…
CVE-2026-47775 2026-06-26 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt() functions use AES-256-…
CVE-2026-49979 2026-06-24 Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values an…
CVE-2025-59872 2026-06-17 HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a …
CVE-2026-47248 2026-06-12 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoint discloses schema met…
CVE-2026-40997 2026-06-11 Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callb…
CVE-2026-41730 2026-06-09 Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0…
CVE-2025-52611 2026-06-04 HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Speci…
CVE-2025-52606 2026-06-04 HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain …
CVE-2026-9794 2026-05-28 A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced …
CVE-2026-42459 2026-05-27 free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Dat…

Previous names

  • Error Message Information Leaks (2009-01-12)
  • Error Message Information Leak (2009-12-28)
  • Information Exposure Through an Error Message (2020-02-24)

Content submission

Name
CLASP
Date
2006-07-19
Version
Draft 3

Content modifications

Date Name Version Importance Comment
2008-07-01 Eric Dalci 1.0 updated Time_of_Introduction
2008-08-15 1.0 Suggested OWASP Top Ten 2004 mapping
2008-09-08 CWE Content Team 1.0 updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
2008-10-14 CWE Content Team 1.0.1 updated Relationships
2009-01-12 CWE Content Team 1.2 updated Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Time_of_Introduction
2009-03-10 CWE Content Team 1.3 updated Demonstrative_Examples, Potential_Mitigations, Relationships
2009-12-28 CWE Content Team 1.7 updated Demonstrative_Examples, Name, Potential_Mitigations, References, Time_of_Introduction
2010-02-16 CWE Content Team 1.8 updated Detection_Factors, References, Relationships
2010-04-05 CWE Content Team 1.8.1 updated Related_Attack_Patterns
2010-06-21 CWE Content Team 1.9 updated Common_Consequences, Detection_Factors, Potential_Mitigations, References
2010-09-09 1.10 Suggested OWASP Top Ten mapping
2010-09-27 CWE Content Team 1.10 updated Potential_Mitigations, Relationships
2011-03-29 CWE Content Team 1.12 updated Demonstrative_Examples, Observed_Examples, Relationships
2011-06-01 CWE Content Team 1.13 updated Relationships, Taxonomy_Mappings
2011-06-27 CWE Content Team 2.0 updated Relationships
2011-09-13 CWE Content Team 2.1 updated Relationships, Taxonomy_Mappings
2012-05-11 CWE Content Team 2.2 updated References, Related_Attack_Patterns, Relationships
2013-07-17 CWE Content Team 2.5 updated References
2014-06-23 CWE Content Team 2.7 updated Relationships
2014-07-30 CWE Content Team 2.8 updated Relationships, Taxonomy_Mappings
2017-11-08 CWE Content Team 3.0 updated Applicable_Platforms, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
2018-03-27 CWE Content Team 3.1 updated References, Relationships
2019-01-03 CWE Content Team 3.2 updated Taxonomy_Mappings
2019-06-20 CWE Content Team 3.3 updated Relationships
2019-09-19 CWE Content Team 3.4 updated Demonstrative_Examples, Observed_Examples
2020-02-24 CWE Content Team 4.0 updated Applicable_Platforms, Description, Name, Observed_Examples, References, Relationships, Weakness_Ordinalities
2020-12-10 CWE Content Team 4.3 updated Potential_Mitigations, Related_Attack_Patterns
2021-07-20 CWE Content Team 4.5 updated Relationships
2021-10-28 CWE Content Team 4.6 updated Relationships
2022-10-13 CWE Content Team 4.9 updated Demonstrative_Examples
2023-01-31 CWE Content Team 4.10 updated Description
2023-04-27 CWE Content Team 4.11 updated Detection_Factors, References, Relationships
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2025-09-09 CWE Content Team 4.18 updated Common_Consequences, Description, Diagram, Other_Notes, References
2025-12-11 CWE Content Team 4.19 updated Applicable_Platforms, Relationships

Contributions

Type Name Date Comment
Feedback Nick Johnston 2022-07-11 Identified incorrect language tag in demonstrative example.
cvelogic Threat Intelligence