The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Primary

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Confidentiality
Read Application Data

Implementation
Build and Compilation
Compilation or Build Hardening
Debugging information should not make its way into a production release.

Implementation
Build and Compilation
Environment Hardening
Debugging information should not make its way into a production release.

The following code uses custom configuration files for each user in the application. It checks to see if the file exists on the system before attempting to open and use the file. If the configuration file does not exist, then an error is generated, and the application exits.

$uname = GetUserInput("username");

# avoid CWE-22, CWE-78, others.
if ($uname !~ /^\w+$/){ExitError("Bad hacker!") ;}
$filename = "/home/myprog/config/" . $uname . ".txt";if (!(-e $filename)){ExitError("Error: $filename does not exist");}

If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that is not associated with a configuration file, an attacker could get this pathname from the error message. It could then be used to exploit path traversal, symbolic link following, or other problems that may exist elsewhere in the application.

CVE-2005-1745
Infoleak of sensitive information in error message (physical access required).
https://www.cve.org/CVERecord?id=CVE-2005-1745

Product-Generated Error Message Infoleak

SFP23
Exposed Data

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-12-28
updated Demonstrative_Examples

CWE Content Team
MITRE
2010-06-21
updated Potential_Mitigations

CWE Content Team
MITRE
2011-03-29
updated Name, Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Name, Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Other_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Functional_Areas, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Name, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Product-Generated Error Message Information Leak
Information Exposure Through Generated Error Message
Information Exposure Through Self-generated Error Message