Security Resilience

CWE · MITRE source

CWE-209Generation of Error Message Containing Sensitive Information

Abstraction: Base · CVEs in our corpus: 644

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Last updated: 14 October 2026 20:41 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-11 Error Handling
  • SI-15 Information Output Filtering
  • SI-17 Fail-safe Procedures
  • AU-13 Monitoring for Information Disclosure
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V16.5.1

NIST 800-53 r5 controls PROPOSED for this weakness (6)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
SI-11Error HandlingSIgraded full Explicitly requires error messages to avoid including sensitive or exploitable details while still supporting corrective action.
SI-15Information Output FilteringSIValidation ensures error messages contain only expected, non-sensitive content and blocks leakage via verbose errors.
SI-17Fail-safe ProceduresSIFail-safe procedures can be defined to suppress or sanitize error output, reducing generation of messages that contain sensitive information.
AU-13Monitoring for Information DisclosureAUDetects error messages that leak sensitive information as evidence of disclosure.
IA-6Authentication FeedbackIAThe control directly mitigates generation of error messages containing sensitive authentication details by requiring obscured feedback instead of verbose responses.
SC-30Concealment and MisdirectionSCMisdirection allows generation of misleading error messages that withhold or falsify sensitive details.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2025-62168 9.610.00.63362025-10-17
CVE-2024-29059 KEV 8.57.50.98622024-03-23
CVE-2026-22778 8.49.80.16702026-02-02
CVE-2013-7331 KEV 7.86.50.50212014-02-26
CVE-2018-11325 7.89.80.03202018-05-22
CVE-2019-7612 7.79.80.02412019-03-25
CVE-2021-22145 7.76.50.76252021-07-21
CVE-2017-7945 7.69.80.01842017-04-29
CVE-2017-7551 7.69.80.01422017-08-16
CVE-2018-14925 7.69.80.01542018-08-03
CVE-2019-7644 7.69.80.01712019-04-11
CVE-2021-42777 7.59.80.01032022-10-29
CVE-2023-40757 7.59.80.00892023-08-28
CVE-2023-40758 7.59.80.00892023-08-28
CVE-2023-40759 7.59.80.00892023-08-28
CVE-2023-40760 7.59.80.00892023-08-28
CVE-2023-40761 7.59.80.00892023-08-28
CVE-2023-40762 7.59.80.00892023-08-28
CVE-2023-40763 7.59.80.01112023-08-28
CVE-2023-40764 7.59.80.00892023-08-28
CVE-2023-40765 7.59.80.00892023-08-28
CVE-2023-40766 7.59.80.00892023-08-28
CVE-2023-40767 7.59.80.00892023-08-28
CVE-2025-47813 KEV 7.54.30.62772025-07-10
CVE-2024-28285 7.39.80.00502024-05-14