CWE-209
AllowedGeneration of Error Message Containing Sensitive Information
Abstraction: Base · Status: Draft
The product generates an error message that includes sensitive information about its environment, users, or associated data.
833 vulnerabilities reference this CWE, most recent first.
GHSA-9FG5-X4R6-5P4P
Vulnerability from github – Published: 2022-12-06 03:30 – Updated: 2022-12-07 18:30Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09, from 12-00 before 12-60-01.
{
"affected": [],
"aliases": [
"CVE-2022-34881"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-06T02:15:00Z",
"severity": "LOW"
},
"details": "Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09, from 12-00 before 12-60-01.",
"id": "GHSA-9fg5-x4r6-5p4p",
"modified": "2022-12-07T18:30:27Z",
"published": "2022-12-06T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34881"
},
{
"type": "WEB",
"url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-140/index.html"
},
{
"type": "WEB",
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-140/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9FXR-6QGM-FPRG
Vulnerability from github – Published: 2025-04-10 15:31 – Updated: 2025-04-10 15:31An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."
{
"affected": [],
"aliases": [
"CVE-2024-11129"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-10T13:15:43Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term.\"",
"id": "GHSA-9fxr-6qgm-fprg",
"modified": "2025-04-10T15:31:48Z",
"published": "2025-04-10T15:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11129"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2717400"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/503722"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GW6-46QC-99VR
Vulnerability from github – Published: 2026-06-11 13:28 – Updated: 2026-06-11 13:28Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
| Field | Value |
|---|---|
| Repository | pipeboard-co/meta-ads-mcp |
| Affected version | ≤ 1.0.101 (commit 496c988 ~ 7d14226); Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. |
| Vulnerability | CWE-287 — Improper Authentication |
| Severity | Critical |
| CVSS 3.1 | 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) |
Summary
AuthInjectionMiddleware.dispatch() at http_auth_integration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable, and when the downstream Meta Graph API call fails, api.py:263–269 serialises the raw httpx request URL—including the operator's access_token as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller.
Affected Code
meta_ads_mcp/core/http_auth_integration.py:272 — middleware unconditionally calls call_next(request) even when no auth headers are present
if not auth_token and not pipeboard_token:
logger.warning("HTTP Auth Middleware: No authentication tokens found in headers")
try:
response = await call_next(request) # line 272: no 401 returned
return response
finally:
if auth_token:
FastMCPAuthIntegration.clear_auth_token()
if pipeboard_token:
FastMCPAuthIntegration.clear_pipeboard_token()
meta_ads_mcp/core/api.py:136 — operator token appended to URL query parameters, exposed verbatim in Graph API error response request_url
request_params = params or {}
request_params["access_token"] = access_token
Unauthenticated HTTP POST /mcp → AuthInjectionMiddleware.dispatch():272 (no 401 returned) → tool handler invokes make_api_request() using META_ACCESS_TOKEN env fallback → request_params["access_token"]:136 (token in URL) → Graph API error path at api.py:263–269 returns request_url containing access_token=… in 200 OK JSON-RPC response.
Proof of Concept
Step 1 — POST /mcp with no auth headers: HTTP 200 OK with operator access_token in request_url — proves unauthenticated tool execution and operator credential leakage.
docker run --rm -p 127.0.0.1:8080:8080 -e META_ACCESS_TOKEN=FAKE_TOKEN_FOR_POC_DEMO_123456789 meta-ads-mcp-vuln001 &
python3 poc.py
POST /mcp HTTP/1.1
Host: 127.0.0.1:8080
Content-Type: application/json
Accept: application/json, text/event-stream
{"jsonrpc":"2.0","method":"tools/call","id":2,"params":{"name":"get_ad_accounts","arguments":{"limit":1}}}
HTTP/1.1 200 OK
Content-Type: application/json
{
"jsonrpc": "2.0",
"id": 2,
"result": {
"content": [
{
"type": "text",
"text": "{\"data\": \"{\\n \\\"error\\\": {\\n \\\"message\\\": \\\"HTTP Error: 400\\\",\\n \\\"details\\\": {\\n \\\"error\\\": {\\n \\\"message\\\": \\\"Invalid OAuth access token data.\\\",\\n \\\"type\\\": \\\"OAuthException\\\",\\n \\\"code\\\": 190\\n }\\n },\\n \\\"full_response\\\": {\\n \\\"status_code\\\": 400,\\n \\\"url\\\": \\\"https://graph.facebook.com/v24.0/me/adaccounts?...&access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\",\\n \\\"request_url\\\": \\\"https://graph.facebook.com/v24.0/me/adaccounts?fields=id%2Cname%2Caccount_id%2Caccount_status%2Camount_spent%2Cbalance%2Ccurrency%2Cage%2Cbusiness_city%2Cbusiness_country_code&limit=1&access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\"\\n }\\n }\\n}\"}"
}
],
"isError": false
}
}
Impact
An unauthenticated attacker who can reach the MCP server's HTTP port (default 8080) can invoke any registered MCP tool as the operator, consuming the operator's Meta Ads API quota and performing read or write operations on connected Meta ad accounts. When any tool call triggers a Graph API error, the operator's META_ACCESS_TOKEN is returned verbatim in the request_url field of the 200 OK JSON-RPC response, enabling the attacker to exfiltrate the long-lived credential and subsequently access the Meta Graph API directly outside the MCP interface.
Remediation
In AuthInjectionMiddleware.dispatch() (http_auth_integration.py), return a 401 Unauthorized response when neither auth_token nor pipeboard_token is present, instead of falling through to call_next:
from starlette.responses import Response
if not auth_token and not pipeboard_token:
return Response(
content='{"error":"Unauthorized"}',
status_code=401,
media_type="application/json",
)
In make_api_request() (api.py), strip access_token from the request_url in error payloads, or transmit the token via an Authorization: Bearer header rather than a URL query parameter to prevent it from appearing in URLs, server logs, or error responses.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.108"
},
"package": {
"ecosystem": "PyPI",
"name": "meta-ads-mcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.109"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48039"
],
"database_specific": {
"cwe_ids": [
"CWE-209",
"CWE-287",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-11T13:28:29Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "# Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token\n\n| Field | Value |\n| ---------------- | ----- |\n| Repository | pipeboard-co/meta-ads-mcp |\n| Affected version | \u2264 1.0.101 (commit 496c988 ~ 7d14226); Versions 1.0.102\u20131.0.105 lack git tags, so patch status is unconfirmed. |\n| Vulnerability | CWE-287 \u2014 Improper Authentication |\n| Severity | Critical |\n| CVSS 3.1 | 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) |\n\n\n## Summary\n\n`AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263\u2013269` serialises the raw `httpx` request URL\u2014including the operator\u0027s `access_token` as a query parameter\u2014into the JSON-RPC response body, delivering the credential to the unauthenticated caller.\n\n## Affected Code\n\n`meta_ads_mcp/core/http_auth_integration.py:272` \u2014 middleware unconditionally calls `call_next(request)` even when no auth headers are present\n\n```python\n if not auth_token and not pipeboard_token:\n logger.warning(\"HTTP Auth Middleware: No authentication tokens found in headers\")\n\n try:\n response = await call_next(request) # line 272: no 401 returned\n return response\n finally:\n if auth_token:\n FastMCPAuthIntegration.clear_auth_token()\n if pipeboard_token:\n FastMCPAuthIntegration.clear_pipeboard_token()\n```\n\n`meta_ads_mcp/core/api.py:136` \u2014 operator token appended to URL query parameters, exposed verbatim in Graph API error response `request_url`\n\n```python\n request_params = params or {}\n request_params[\"access_token\"] = access_token\n```\n\nUnauthenticated HTTP POST /mcp \u2192 `AuthInjectionMiddleware.dispatch():272` (no 401 returned) \u2192 tool handler invokes `make_api_request()` using `META_ACCESS_TOKEN` env fallback \u2192 `request_params[\"access_token\"]:136` (token in URL) \u2192 Graph API error path at `api.py:263\u2013269` returns `request_url` containing `access_token=\u2026` in 200 OK JSON-RPC response.\n\n## Proof of Concept\n\nStep 1 \u2014 POST /mcp with no auth headers: HTTP 200 OK with operator `access_token` in `request_url` \u2014 proves unauthenticated tool execution and operator credential leakage.\n\n```bash\ndocker run --rm -p 127.0.0.1:8080:8080 -e META_ACCESS_TOKEN=FAKE_TOKEN_FOR_POC_DEMO_123456789 meta-ads-mcp-vuln001 \u0026\npython3 poc.py\n```\n\n```http\nPOST /mcp HTTP/1.1\nHost: 127.0.0.1:8080\nContent-Type: application/json\nAccept: application/json, text/event-stream\n\n{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"id\":2,\"params\":{\"name\":\"get_ad_accounts\",\"arguments\":{\"limit\":1}}}\n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json\n\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"result\": {\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"{\\\"data\\\": \\\"{\\\\n \\\\\\\"error\\\\\\\": {\\\\n \\\\\\\"message\\\\\\\": \\\\\\\"HTTP Error: 400\\\\\\\",\\\\n \\\\\\\"details\\\\\\\": {\\\\n \\\\\\\"error\\\\\\\": {\\\\n \\\\\\\"message\\\\\\\": \\\\\\\"Invalid OAuth access token data.\\\\\\\",\\\\n \\\\\\\"type\\\\\\\": \\\\\\\"OAuthException\\\\\\\",\\\\n \\\\\\\"code\\\\\\\": 190\\\\n }\\\\n },\\\\n \\\\\\\"full_response\\\\\\\": {\\\\n \\\\\\\"status_code\\\\\\\": 400,\\\\n \\\\\\\"url\\\\\\\": \\\\\\\"https://graph.facebook.com/v24.0/me/adaccounts?...\u0026access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\\\\\",\\\\n \\\\\\\"request_url\\\\\\\": \\\\\\\"https://graph.facebook.com/v24.0/me/adaccounts?fields=id%2Cname%2Caccount_id%2Caccount_status%2Camount_spent%2Cbalance%2Ccurrency%2Cage%2Cbusiness_city%2Cbusiness_country_code\u0026limit=1\u0026access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\\\\\"\\\\n }\\\\n }\\\\n}\\\"}\"\n }\n ],\n \"isError\": false\n }\n}\n```\n\n## Impact\n\nAn unauthenticated attacker who can reach the MCP server\u0027s HTTP port (default 8080) can invoke any registered MCP tool as the operator, consuming the operator\u0027s Meta Ads API quota and performing read or write operations on connected Meta ad accounts. When any tool call triggers a Graph API error, the operator\u0027s `META_ACCESS_TOKEN` is returned verbatim in the `request_url` field of the 200 OK JSON-RPC response, enabling the attacker to exfiltrate the long-lived credential and subsequently access the Meta Graph API directly outside the MCP interface.\n\n## Remediation\n\nIn `AuthInjectionMiddleware.dispatch()` (`http_auth_integration.py`), return a `401 Unauthorized` response when neither `auth_token` nor `pipeboard_token` is present, instead of falling through to `call_next`:\n\n```python\nfrom starlette.responses import Response\n\nif not auth_token and not pipeboard_token:\n return Response(\n content=\u0027{\"error\":\"Unauthorized\"}\u0027,\n status_code=401,\n media_type=\"application/json\",\n )\n```\n\nIn `make_api_request()` (`api.py`), strip `access_token` from the `request_url` in error payloads, or transmit the token via an `Authorization: Bearer` header rather than a URL query parameter to prevent it from appearing in URLs, server logs, or error responses.",
"id": "GHSA-9gw6-46qc-99vr",
"modified": "2026-06-11T13:28:29Z",
"published": "2026-06-11T13:28:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-9gw6-46qc-99vr"
},
{
"type": "PACKAGE",
"url": "https://github.com/pipeboard-co/meta-ads-mcp"
},
{
"type": "WEB",
"url": "https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.109"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token"
}
GHSA-9JG2-V5F3-RQF2
Vulnerability from github – Published: 2024-10-16 21:31 – Updated: 2024-10-17 18:31A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
{
"affected": [],
"aliases": [
"CVE-2024-44762"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-16T21:15:12Z",
"severity": "MODERATE"
},
"details": "A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.",
"id": "GHSA-9jg2-v5f3-rqf2",
"modified": "2024-10-17T18:31:35Z",
"published": "2024-10-16T21:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44762"
},
{
"type": "WEB",
"url": "https://senscybersecurity.nl/cve-2024-44762-explained"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9P6Q-5M74-R2RR
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2023-01-31 21:30IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.
{
"affected": [],
"aliases": [
"CVE-2019-4308"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-20T19:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.",
"id": "GHSA-9p6q-5m74-r2rr",
"modified": "2023-01-31T21:30:17Z",
"published": "2022-05-24T16:54:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4308"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/161034"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880221"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9P7X-RVCJ-9WG6
Vulnerability from github – Published: 2024-01-09 18:30 – Updated: 2024-01-09 18:30Windows TCP/IP Information Disclosure Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-21313"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T18:15:55Z",
"severity": "MODERATE"
},
"details": "Windows TCP/IP Information Disclosure Vulnerability",
"id": "GHSA-9p7x-rvcj-9wg6",
"modified": "2024-01-09T18:30:29Z",
"published": "2024-01-09T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21313"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21313"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9Q87-5V6F-82PH
Vulnerability from github – Published: 2025-01-07 18:30 – Updated: 2025-01-07 18:30IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.
{
"affected": [],
"aliases": [
"CVE-2024-25037"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T16:15:32Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.",
"id": "GHSA-9q87-5v6f-82ph",
"modified": "2025-01-07T18:30:49Z",
"published": "2025-01-07T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25037"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7179163"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9RGV-H7X4-QW8G
Vulnerability from github – Published: 2018-10-19 16:15 – Updated: 2023-08-18 16:47In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.4.10.v20180503"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty:jetty-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.4.0"
},
{
"fixed": "9.4.11.v20180605"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.3.23.v20180228"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty:jetty-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.3.24.v20180605"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-12536"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:29:36Z",
"nvd_published_at": "2018-06-27T17:29:00Z",
"severity": "MODERATE"
},
"details": "In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn\u0027t match a dynamic url-pattern, and is eventually handled by the DefaultServlet\u0027s static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.",
"id": "GHSA-9rgv-h7x4-qw8g",
"modified": "2023-08-18T16:47:12Z",
"published": "2018-10-19T16:15:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12536"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse/jetty.project"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20181014-0001"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03953en_us"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200516001904/http://www.securitytracker.com/id/1041194"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Eclipse Jetty Server generates error message containing sensitive information"
}
GHSA-9VWQ-J6GQ-W9XH
Vulnerability from github – Published: 2025-09-09 03:30 – Updated: 2025-09-10 20:09Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.portal.security.sso.openid.connect.impl"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.4"
},
{
"fixed": "7.0.48"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-43777"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-10T20:09:24Z",
"nvd_published_at": "2025-09-09T03:15:32Z",
"severity": "MODERATE"
},
"details": "Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes \"Internal Server Error\" in the response body when a login attempt is made with a deleted Client Secret.",
"id": "GHSA-9vwq-j6gq-w9xh",
"modified": "2025-09-10T20:09:24Z",
"published": "2025-09-09T03:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43777"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/e4ae0e49dd90485f2f2d8d07ab972da5aba7fa45"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43777"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Liferay Portal exposes 500 status when attempting login with a deleted client secret"
}
GHSA-9VXV-WPV4-F52P
Vulnerability from github – Published: 2021-05-21 14:29 – Updated: 2021-05-18 16:06Impact
Information leakage in Error Handler
Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.6.9"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/shopware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.6.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-18T16:06:57Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nInformation leakage in Error Handler\n\n### Patches\nWe recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.\n\nFor older versions you can use the Security Plugin:\nhttps://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html\n\n\n### References\nhttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021",
"id": "GHSA-9vxv-wpv4-f52p",
"modified": "2021-05-18T16:06:57Z",
"published": "2021-05-21T14:29:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/security/advisories/GHSA-9vxv-wpv4-f52p"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Information leakage in Error Handler"
}
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Mitigation
Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Mitigation MIT-33
Strategy: Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Mitigation MIT-40
Strategy: Compilation or Build Hardening
Debugging information should not make its way into a production release.
Mitigation MIT-40
Strategy: Environment Hardening
Debugging information should not make its way into a production release.
Mitigation
Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Mitigation
Create default error pages or messages that do not leak any information.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-54: Query System for Information
An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.
CAPEC-7: Blind SQL Injection
Blind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection is a form of SQL Injection that overcomes the lack of error messages. Without the error messages that facilitate SQL Injection, the adversary constructs input strings that probe the target through simple Boolean SQL expressions. The adversary can determine if the syntax and structure of the injection was successful based on whether the query was executed or not. Applied iteratively, the adversary determines how and where the target is vulnerable to SQL Injection.