目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-209 通过错误消息导致的信息暴露 类漏洞列表 331

CWE-209 通过错误消息导致的信息暴露 类弱点 331 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-209属于信息泄露漏洞，指软件在生成错误消息时意外包含敏感的环境、用户或数据信息。攻击者通常利用这些详细的错误堆栈或路径信息，识别系统架构、数据库结构或用户身份，从而辅助后续更精准的定向攻击。开发者应避免在生产环境中暴露内部细节，通过配置统一的通用错误页面、过滤敏感字段及记录日志而非直接展示，来防止敏感数据外泄。

MITRE CWE 官方描述
CWE：CWE-209 生成包含敏感信息的错误消息 (Generation of Error Message Containing Sensitive Information) 英文：产品生成的错误消息 (error message) 包含了关于其环境、用户或关联数据的敏感信息 (sensitive information)。
常见影响 (1)
ConfidentialityRead Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In tur…
缓解措施 (5)
ImplementationEnsure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
ImplementationHandle exceptions internally and do not display errors containing potentially sensitive information to a user.
ImplementationUse naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Effectiveness: Defense in Depth
Implementation, Build and CompilationDebugging information should not make its way into a production release.
Implementation, Build and CompilationDebugging information should not make its way into a production release.
代码示例 (2)
In the following example, sensitive information might be printed depending on the exception that occurs.
try { /.../ } catch (Exception e) { System.out.println(e); }
Bad · Java
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE ID标题CVSS风险等级Published
CVE-2025-53803 Microsoft Windows Kernel 安全漏洞 — Windows 10 Version 1507 5.5 Medium2025-09-09
CVE-2025-43776 Liferay Portal和Liferay DXP 安全漏洞 — Portal 5.4AIMediumAI2025-09-09
CVE-2025-59016 TYPO3 CMS 安全漏洞 — TYPO3 CMS 4.3AIMediumAI2025-09-09
CVE-2025-43777 Liferay Portal和Liferay DXP 安全漏洞 — Portal 7.5AIHighAI2025-09-09
CVE-2025-36003 IBM Security Verify Governance Identity Manager 安全漏洞 — Security Verify Governance Identity Manager 7.5 High2025-08-28
CVE-2025-9229 Mobile Industrial Robots MiR controllers 安全漏洞 — MiR Robots 5.3 Medium2025-08-20
CVE-2025-52619 HCL BigFix SaaS Authentication Service 安全漏洞 — BigFix SaaS Remediate 5.3 Medium2025-08-15
CVE-2025-9005 mblog 安全漏洞 — mblog 3.7 Low2025-08-15
CVE-2025-54791 OMERO.web 安全漏洞 — omero-web 5.3 Medium2025-08-13
CVE-2024-41984 Siemens多款产品 安全漏洞 — SmartClient modules Opcenter QL Home (SC) 2.6 Low2025-08-12
CVE-2024-41983 Siemens SmartClient modules Opcenter QL Home 安全漏洞 — SmartClient modules Opcenter QL Home (SC) 3.5 Low2025-08-12
CVE-2025-8852 WukongCRM 安全漏洞 — WukongCRM 4.3 Medium2025-08-11
CVE-2025-23320 NVIDIA Triton Inference Server 安全漏洞 — Triton Inference Server 7.5 High2025-08-06
CVE-2025-8548 pybbs 安全漏洞 — pybbs 3.7 Low2025-08-05
CVE-2025-36090 IBM Analytics Content Hub 安全漏洞 — Analytics Content Hub 4.3 Medium2025-07-10
CVE-2024-37524 IBM Analytics Content Hub 安全漏洞 — Analytics Content Hub 5.3 Medium2025-07-10
CVE-2025-47813 Wing FTP Server 安全漏洞 — Wing FTP Server 4.3 Medium2025-07-10
CVE-2025-40718 Quiter Gateway 安全漏洞 — Quiter Gateway (Java WAR on Apache Tomcat) 5.3AIMediumAI2025-07-08
CVE-2025-5731 Infinispan CLI 安全漏洞 — infinispan 5.5 Medium2025-06-26
CVE-2025-49128 FasterXML jackson-core 安全漏洞 — jackson-core 4.0 Medium2025-06-06
CVE-2024-56342 IBM Verify Identity Access Digital Credentials 安全漏洞 — Verify Identity Access Digital Credentials 4.3 Medium2025-06-06
CVE-2025-25025 IBM Security Guardium 安全漏洞 — Security Guardium 4.3 Medium2025-05-28
CVE-2025-40653 M3M Printer Server Web 安全漏洞 — M3M Printer Server Web 5.3AIMediumAI2025-05-26
CVE-2025-41441 SYNCK GRAPHICA Mailform Pro CGI 安全漏洞 — Mailform Pro CGI 5.3AIMediumAI2025-05-26
CVE-2025-46746 Schweitzer Engineering Laboratories多款产品 安全漏洞 — SEL Blueframe OS 5.8 Medium2025-05-12
CVE-2025-4166 HashiCorp Vault Enterprise和HashiCorp Vault Community 安全漏洞 — Vault 4.5 Medium2025-05-02
CVE-2025-0049 Fortra GoAnywhere 安全漏洞 — GoAnywhere 3.5 Low2025-04-28
CVE-2025-46575 ZTE GoldenDB 安全漏洞 — GoldenDB 4.9 Medium2025-04-27
CVE-2025-25045 IBM InfoSphere Information Server 安全漏洞 — InfoSphere Information Server 4.3 Medium2025-04-23
CVE-2025-20150 Cisco Nexus Dashboard 安全漏洞 — Cisco Nexus Dashboard 5.3 Medium2025-04-16

CWE-209（通过错误消息导致的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 331 条 CVE 漏洞。