Common Weakness Enumeration

CWE-211

Weakness Allowed

Externally-Generated Error Message Containing Sensitive Information

Abstraction: Base · Status: Incomplete

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-209 · View CWE-1000

Modes of introduction

Architecture and Design

PHP applications are often targeted for having this issue when the PHP interpreter generates the error outside of the application's control. However, other languages/environments exhibit the same issue.

Implementation

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Operation

Notes

Relationship

This is inherently a resultant vulnerability from a weakness within the product or an interaction error.

Content history

Submission: PLOVER · 2006-07-19 · CWE Draft 3

Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Time_of_Introduction

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2008-10-14 · CWE 1.0.1

updated Description

Modification: CWE Content Team · MITRE · 2008-11-24 · CWE 1.1

updated Description, Enabling_Factors_for_Exploitation, Functional_Areas, Observed_Examples, Other_Notes, Potential_Mitigations, Relationship_Notes, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2010-06-21 · CWE 1.9

updated Potential_Mitigations

Modification: CWE Content Team · MITRE · 2010-12-13 · CWE 1.11

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2011-03-29 · CWE 1.12

updated Name

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Relationships

Modification: CWE Content Team · MITRE · 2012-10-30 · CWE 2.3

updated Name

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Applicable_Platforms, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Description, Name, Relationships

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2024-02-29 · CWE 4.14

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms

0 vulnerabilities reference this CWE, most recent first.

No vulnerabilities reference this CWE.

Mitigation

System Configuration

Configure the application's environment in a way that prevents errors from being generated. For example, in PHP, disable display_errors.

Mitigation MIT-40

Implementation Build and Compilation

Strategy: Compilation or Build Hardening

Debugging information should not make its way into a production release.

Mitigation MIT-40

Implementation Build and Compilation

Strategy: Environment Hardening

Debugging information should not make its way into a production release.

Mitigation

Implementation

Handle exceptions internally and do not display errors containing potentially sensitive information to a user. Create default error pages if necessary.

Mitigation

Implementation

The best way to prevent this weakness during implementation is to avoid any bugs that could trigger the external error message. This typically happens when the program encounters fatal errors, such as a divide-by-zero. You will not always be able to control the use of error pages, and you might not be using a language that handles exceptions.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list