Falhas do tipo CWE-209

482 resultados

Exposição de Informações Sensíveis em Mensagens de Erro

A aplicação expõe detalhes técnicos internos (caminhos de arquivos, versões de banco de dados, stack traces, credenciais) em mensagens de erro exibidas ao usuário. Um atacante usa essas informações para mapear a infraestrutura, identificar versões vulneráveis e planejar ataques mais precisos.

Exemplo

Um aplicativo PHP exibe erro de conexão com banco: 'Fatal error: Cannot connect to MySQL at /var/www/html/db.php line 42, user: root@192.168.1.5'. O atacante descobre o caminho do servidor, versão do MySQL, IP interno e usuário administrativo — tudo que precisa para explorar o sistema.

Como mitigar

Exiba mensagens genéricas ao usuário ('Erro ao processar requisição') e registre os detalhes reais em logs do servidor que só administradores acessam. Configure o ambiente de produção para desabilitar stack traces visíveis (debug=false em frameworks).

CVE-2023-26051MEDIUMSaleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptionsEPSS 0.8%CVE-2024-47803MEDIUMJenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissionsEPSS 0.8%CVE-2024-45384MEDIUMApache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle AttackEPSS 0.8%CVE-2023-23837HIGHNo Exception Handling Vulnerability: Database Performance Analyzer (DPA) 2023.1EPSS 0.8%CVE-2022-22760MEDIUMWhen importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> respEPSS 0.8%CVE-2022-22363MEDIUMIBM Cognos Controller information disclosureEPSS 0.8%CVE-2023-31048MEDIUMThe OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.EPSS 0.8%CVE-2021-33711—A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versionEPSS 0.8%CVE-2022-31229CRITICALDell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploiEPSS 0.8%CVE-2021-32775HIGHAny user can see any fields (including mailbox password) with GroupBy DashletEPSS 0.8%CVE-2023-46240HIGHCodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environmentEPSS 0.8%CVE-2020-1717—A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.EPSS 0.8%CVE-2023-29193HIGHSpiceDB binding metrics port to untrusted networks and can leak command-line flagsEPSS 0.8%CVE-2021-31339—A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an EPSS 0.8%CVE-2023-26052LOWSaleor is vulnerable to unauthenticated information disclosure via Python exceptionsEPSS 0.8%CVE-2023-47703MEDIUMIBM Security Guardium Key Lifecycle Manager information disclosureEPSS 0.8%CVE-2018-19947MEDIUMThe vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disEPSS 0.8%CVE-2019-16768LOWInternal exception message exposure for login action in SyliusEPSS 0.7%CVE-2023-33835MEDIUMIBM Security Verify Information Queue information disclosureEPSS 0.7%CVE-2020-5026MEDIUMIBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitEPSS 0.7%