Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1295: Debug Messages Revealing Unnecessary Information

Base Incomplete

The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.

More detail

Debug messages are messages that help troubleshoot an issue by revealing the internal state of the system. For example, debug data in design can be exposed through internal memory array dumps or boot logs through interfaces like UART via TAP commands, scan chain, etc. Thus, the more information contained in a debug message, the easier it is to debug. However, there is also the risk of revealing information that could help an attacker either decipher a vulnerability, and/or gain a better understanding of the system. Thus, this extra information could lower the "security by obscurity" factor. While "security by obscurity" alone is insufficient, it can help as a part of "Defense-in-depth".

How to prevent it (1 mitigation)

  1. Implementation

    Ensure that a debug message does not reveal any unnecessary information during the debug process for the intended response.

Source: MITRE CWE-1295

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2026-28811

    Apache JSPWiki: Error Handling - Reveals Error Details

    Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.

    Apache Software Foundation Apache JSPWiki
  • High 7.5
    CVE-2025-31001

    WordPress GTM Kit plugin <= 2.4.0 - Sensitive Data Exposure vulnerability

    Debug Messages Revealing Unnecessary Information vulnerability in TLA Media GTM Kit gtm-kit allows Retrieve Embedded Sensitive Data.This issue affects GTM Kit: from n/a through <= 2.4.0.

    TLA Media GTM Kit
  • High 7.5
    CVE-2024-45784

    Apache Airflow: Sensitive configuration values are not masked in the logs by default

    Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users…

    Apache Software Foundation Apache Airflow apache-airflow airflow PyPI
  • High 8.8
    CVE-2024-38516

    Aimeos HTML client may potentially reveal sensitive information in error log

    ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.

    aimeos ai-client-html aimeos/ai-client-html Packagist
  • High 7.5
    CVE-2023-5392

    C300 information leak due to an analysis feature which allows extracting more memory over the network than required by …

    Honeywell C300 ICS / OT