MITRE’s description of CWE-209: The product generates an error message that includes sensitive information about its environment, users, or associated data.
Common consequences MITRE lists
- Confidentiality: Read Application Data
Detailed errors map the system for an attacker, disclosing versions, queries and internal paths, and sometimes the data itself.
- Return a generic message and a correlation ID to the client, and log the details on the server.
- Disable debug modes and framework error pages in production.
- Handle exceptions centrally so every route returns the same safe error response.
Guides on this site
Handle failures without leaking internals or weakening controls
Give callers a useful, bounded response while preserving protected diagnostic evidence and safe application state.
Ship without debug modes, verbose errors or exposed files
Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.
References
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.