Missing Custom Error Page

Opis

The product does not return custom error pages to the user, possibly exposing sensitive information.

Skutki

• Confidentiality

  Read Application Data

  Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.

Przykłady podatności

• CVE-2023-27998 analytics platform does not have a custom error page, allowing access to sensitive information

Słabość nadrzędna

• CWE-755 Improper Handling of Exceptional Conditions

Może prowadzić do

• CWE-209 Generation of Error Message Containing Sensitive Information

Słabości podrzędne

• CWE-7 J2EE Misconfiguration: Missing Custom Error Page
• CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page

Kiedy powstaje

• Installation
• System Configuration
• Operation

Dotyczy

Not Language-Specific, Web Server