CWE-1295 - Debug Messages Revealing Unnecessary Information

Read Time:27 Second

Description

The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.

Modes of Introduction:

– Implementation

Related Weaknesses

CWE-200
CWE-209

Consequences

Confidentiality, Integrity, Availability, Access Control, Accountability, Authentication, Authorization, Non-Repudiation: Read Memory, Bypass Protection Mechanism, Gain Privileges or Assume Identity, Varies by Context

Potential Mitigations

Phase: Implementation

Description:

Ensure that a debug message does not reveal any unnecessary information during the debug process for the intended response.

CVE References

CVE-2017-18326
- modem debug messages include cryptographic keys

InCVE-2017-18326, CWE- 1295, Debug Messages Revealing Unnecessary Information

The Most Dangerous Vulnerabilities in Apache Tomcat and How to Protect Against Them

Apache Tomcat is an open-source web server and servlet container that is widely used in enterprise environments to run Java...

rocco

February 19, 2023February 19, 2023

ZDI-CAN-18333: A Critical Zero-Day Vulnerability in Microsoft Windows

Zero-day vulnerabilities are a serious threat to cybersecurity, as they can be exploited by malicious actors to gain unauthorized access...

rocco

February 19, 2023February 19, 2023

CWE-669 – Incorrect Resource Transfer Between Spheres

Description The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere,...

rocco

May 26, 2022