CWE-215: Insertion of Sensitive Information Into Debugging Code
Description
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Extended Description
When debugging, it may be necessary to report detailed information to the programmer. However, if the debugging code is not disabled when the product is operating in a production environment, then this sensitive information may be exposed to attackers.
Example - 1
The following program changes its behavior based on a debug flag. The code writes sensitive debug information to the client browser if the "debugEnabled" flag is set to true .
%>User account number: <%= acctNo %><%} %><% if (Boolean.getBoolean("debugEnabled")) {
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.