CWE-209
AllowedGeneration of Error Message Containing Sensitive Information
Abstraction: Base · Status: Draft
The product generates an error message that includes sensitive information about its environment, users, or associated data.
839 vulnerabilities reference this CWE, most recent first.
GHSA-C8HJ-W239-5GVF
Vulnerability from github – Published: 2023-11-15 14:49 – Updated: 2023-11-15 23:22Impact
Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view.
In the case of pimcore, the fopen() function here doesn't have an error handle when the file doesn't exist on the server so the server response raises the full path "fopen(/var/www/html/var/tmp/export-{ uniqe id}.csv)"
Patches
Apply patch https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87.patch
Workarounds
Update to version 1.2.1 or apply patches manually
References
https://huntr.com/bounties/4af4db18-9fd4-43e9-8bc6-c88aaf76839c/
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/admin-ui-classic-bundle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-47636"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2023-11-15T14:49:41Z",
"nvd_published_at": "2023-11-15T20:15:07Z",
"severity": "MODERATE"
},
"details": "### Impact\nFull Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view.\n\nIn the case of pimcore, the fopen() function here doesn\u0027t have an error handle when the file doesn\u0027t exist on the server so the server response raises the full path \"fopen(/var/www/html/var/tmp/export-{ uniqe id}.csv)\"\n\n### Patches\nApply patch https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87.patch\n\n### Workarounds\nUpdate to version 1.2.1 or apply [patches](https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87.patch) manually\n\n### References\nhttps://huntr.com/bounties/4af4db18-9fd4-43e9-8bc6-c88aaf76839c/",
"id": "GHSA-c8hj-w239-5gvf",
"modified": "2023-11-15T23:22:45Z",
"published": "2023-11-15T14:49:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-c8hj-w239-5gvf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47636"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/admin-ui-classic-bundle"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/4af4db18-9fd4-43e9-8bc6-c88aaf76839c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document"
}
GHSA-CC8F-FCX3-GPJR
Vulnerability from github – Published: 2026-06-19 22:10 – Updated: 2026-06-19 22:10SurrealDB's full-text search lets you define a text analyzer whose mapper filter loads a term-mapping file from disk (DEFINE ANALYZER ... FILTERS mapper('<path>')). A database user with the EDITOR or OWNER role could point that filter at any file the SurrealDB process can read and have its content returned in the query's error message.
File access is meant to be restricted by the SURREAL_FILE_ALLOWLIST setting, but an empty allowlist applied no restriction at all — and empty is the default.
Impact
The file is read with the privileges of the SurrealDB process, so a database EDITOR or OWNER user can disclose the contents of any file the process can access. Only the first line of the file is returned, except for files with no newlines.
However recovering the process's command line and environment could expose startup root credentials (--user / --pass) and secret environment variables, escalating a single-database role toward full control of the instance.
The read on the underlying filesystem is bounded by what the SurrealDB process can reach — any file readable by the OS user it runs as — so the impact scales with how the process is run and what is mounted into it.
Patches
A patch has been included in SurrealDB 3.1.5.
File access is now secure by default. check_is_path_allowed denies every path when no SURREAL_FILE_ALLOWLIST is configured, so the mapper filter cannot open any file unless the operator has explicitly allowed its directory. Analyzer parse errors no longer include the contents of the mapped file, only the line number.
Workarounds
Users unable to upgrade are advised to consider the following:
- Set
SURREAL_FILE_ALLOWLISTto a directory that contains only the intended mapping files; this confines themapperfilter to that path. On affected versions the allowlist must be non-empty to have any effect. - Grant the
EDITORandOWNERdatabase roles only to trusted principals. - Avoid supplying secrets — including the root credentials — on the command line or through environment variables; prefer mounted files with least-privilege permissions.
References
- SurrealQL Documentation — DEFINE ANALYZER
- SurrealDB Documentation — Capabilities
- Related earlier advisory: GHSA-2cvj-g5r5-jrrg local file read of 2-column TSV files via analyzers
- https://github.com/surrealdb/surrealdb/pull/5600
- fix(iam): deny filesystem access by default and stop leaking file content in analyzer errors
Acknowledgements
Thanks to Jan Kahmen (@kah-ja) for finding and reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-209",
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T22:10:48Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "SurrealDB\u0027s full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (`DEFINE ANALYZER ... FILTERS mapper(\u0027\u003cpath\u003e\u0027)`). A database user with the `EDITOR` or `OWNER` role could point that filter at any file the SurrealDB process can read and have its content returned in the query\u0027s error message.\n\nFile access is meant to be restricted by the `SURREAL_FILE_ALLOWLIST` setting, but an empty allowlist applied no restriction at all \u2014 and empty is the default. \n\n## Impact\n\nThe file is read with the privileges of the SurrealDB process, so a database `EDITOR` or `OWNER` user can disclose the contents of any file the process can access. Only the **first line** of the file is returned, except for files with no newlines.\n\nHowever recovering the process\u0027s command line and environment could expose startup root credentials (`--user` / `--pass`) and secret environment variables, escalating a single-database role toward full control of the instance.\n\nThe read on the underlying filesystem is bounded by what the SurrealDB process can reach \u2014 any file readable by the OS user it runs as \u2014 so the impact scales with how the process is run and what is mounted into it.\n\n## Patches\n\nA patch has been included in SurrealDB 3.1.5.\n\nFile access is now secure by default. `check_is_path_allowed` denies every path when no `SURREAL_FILE_ALLOWLIST` is configured, so the `mapper` filter cannot open any file unless the operator has explicitly allowed its directory. Analyzer parse errors no longer include the contents of the mapped file, only the line number.\n\n## Workarounds\n\nUsers unable to upgrade are advised to consider the following:\n\n- Set `SURREAL_FILE_ALLOWLIST` to a directory that contains only the intended mapping files; this confines the `mapper` filter to that path. On affected versions the allowlist must be non-empty to have any effect.\n- Grant the `EDITOR` and `OWNER` database roles only to trusted principals.\n- Avoid supplying secrets \u2014 including the root credentials \u2014 on the command line or through environment variables; prefer mounted files with least-privilege permissions.\n\n## References\n\n- [SurrealQL Documentation \u2014 DEFINE ANALYZER](https://surrealdb.com/docs/surrealql/statements/define/analyzer#define-analyzer-statement)\n- [SurrealDB Documentation \u2014 Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities)\n- Related earlier advisory: [GHSA-2cvj-g5r5-jrrg](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg) local file read of 2-column TSV files via analyzers\n- https://github.com/surrealdb/surrealdb/pull/5600\n- fix(iam): deny filesystem access by default and stop leaking file content in analyzer errors\n\n## Acknowledgements\n\nThanks to Jan Kahmen ([@kah-ja](https://github.com/kah-ja)) for finding and reporting this issue.",
"id": "GHSA-cc8f-fcx3-gpjr",
"modified": "2026-06-19T22:10:48Z",
"published": "2026-06-19T22:10:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-cc8f-fcx3-gpjr"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/pull/5600"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter"
}
GHSA-CFPF-6674-H88V
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Force ID: 196309.
{
"affected": [],
"aliases": [
"CVE-2021-20424"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-13T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Force ID: 196309.",
"id": "GHSA-cfpf-6674-h88v",
"modified": "2022-05-24T19:07:32Z",
"published": "2022-05-24T19:07:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20424"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196309"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6471325"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CFQH-HP29-CJQ6
Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. This could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.
{
"affected": [],
"aliases": [
"CVE-2025-40760"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T21:15:37Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Altair Grid Engine (All versions \u003c V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.\nThis could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks.",
"id": "GHSA-cfqh-hp29-cjq6",
"modified": "2025-11-11T21:30:28Z",
"published": "2025-11-11T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40760"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-514895.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CFQM-RCFX-9R9W
Vulnerability from github – Published: 2023-02-11 03:32 – Updated: 2023-02-21 21:30Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for further vulnerability research.
{
"affected": [],
"aliases": [
"CVE-2022-46675"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-11T01:23:00Z",
"severity": "MODERATE"
},
"details": "Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentially discover the internal structure of the application and its components and use this information for further vulnerability research.",
"id": "GHSA-cfqm-rcfx-9r9w",
"modified": "2023-02-21T21:30:19Z",
"published": "2023-02-11T03:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46675"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJR9-MR35-7XH6
Vulnerability from github – Published: 2023-04-13 17:53 – Updated: 2023-04-14 21:35Background
The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data.
The /debug/pprof/cmdline endpoint served by the metrics service (defaulting running on port 9090) reveals the command-line flags provided for debugging purposes. If a password is set via the --grpc-preshared-key then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary.
Impact
All deployments abiding by the recommended best practices for production usage are NOT affected: - Authzed's SpiceDB Serverless - Authzed's SpiceDB Dedicated - SpiceDB Operator
Users configuring SpiceDB via environment variables are NOT affected.
Users MAY be affected if they expose their metrics port to an untrusted network and are configuring --grpc-preshared-key via command-line flag.
Workarounds
To workaround this issue you can do one of the following:
- Configure the preshared key via an environment variable (e.g.
SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve) - Reconfigure the
--metrics-addrflag to bind to a trusted network (e.g.--metrics-addr=localhost:9090) - Disable the metrics service via the flag (e.g.
--metrics-enabled=false) - Adopt one of the recommended deployment models: Authzed's managed services or the SpiceDB Operator
References
- GitHub Security Advisory issued for SpiceDB
- Go issue #22085 for documenting the risks of exposing pprof to the internet
- Go issue #42834 discusses preventing pprof registration to the default serve mux
- semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure checks for a variation of this issue
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/authzed/spicedb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.19.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-29193"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-13T17:53:38Z",
"nvd_published_at": "2023-04-14T20:15:00Z",
"severity": "HIGH"
},
"details": "### Background\n\nThe `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data.\n\nThe `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary.\n\n### Impact\n\nAll deployments abiding by the recommended best practices for production usage are **NOT affected**:\n- Authzed\u0027s SpiceDB Serverless\n- Authzed\u0027s SpiceDB Dedicated\n- SpiceDB Operator\n\nUsers configuring SpiceDB via environment variables are **NOT affected**.\n\nUsers **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag.\n\n### Workarounds\n\nTo workaround this issue you can do one of the following:\n\n- Configure the preshared key via an environment variable (e.g. `SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve`)\n- Reconfigure the `--metrics-addr` flag to bind to a trusted network (e.g. `--metrics-addr=localhost:9090`)\n- Disable the metrics service via the flag (e.g. `--metrics-enabled=false`)\n- Adopt one of the recommended deployment models: [Authzed\u0027s managed services](https://authzed.com/pricing) or the [SpiceDB Operator](https://github.com/authzed/spicedb-operator)\n\n### References\n\n- [GitHub Security Advisory issued for SpiceDB](https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6)\n- [Go issue #22085](https://github.com/golang/go/issues/22085) for documenting the risks of exposing pprof to the internet\n- [Go issue #42834](https://github.com/golang/go/issues/42834) discusses preventing pprof registration to the default serve mux\n- [semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure](https://semgrep.dev/r?q=go.lang.security.audit.net.pprof) checks for a variation of this issue",
"id": "GHSA-cjr9-mr35-7xh6",
"modified": "2023-04-14T21:35:43Z",
"published": "2023-04-13T17:53:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29193"
},
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/commit/9bbd7d76b6eaba33fe0236014f9b175d21232999"
},
{
"type": "PACKAGE",
"url": "https://github.com/authzed/spicedb"
},
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/releases/tag/v1.19.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "SpiceDB binding metrics port to untrusted networks and can leak command-line flags"
}
GHSA-CM22-PWH9-X3R2
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219
{
"affected": [],
"aliases": [
"CVE-2021-20417"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196219",
"id": "GHSA-cm22-pwh9-x3r2",
"modified": "2022-05-24T19:06:59Z",
"published": "2022-05-24T19:06:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20417"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196219"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6469691"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CPH6-524F-3HGR
Vulnerability from github – Published: 2025-11-13 23:07 – Updated: 2025-11-15 03:15Summary:
An observable difference in error messaging was found in the Directus REST API. The /items/{collection} API returns different error messages for these two cases:
1. A user tries to access an existing collection which they are not authorized to access.
2. A user tries to access a non-existing collection.
The two differing error messages leak the existence of collections to users which are not authorized to access these collections.
Details:
The following response returns an error message, when requesting a collection the user is not authorized to access.
GET /items/no-access
{
"errors": [
{
"message": "You don't have permission to access collection \"no-access\" or it does not exist. Queried in root.",
"extensions": {
"reason": "You don't have permission to access collection \"no-access\" or it does not exist. Queried in root.",
"code": "FORBIDDEN"
}
}
]
}
The following response returns a different error message when requesting a collection which does not exist.
GET /items/does-not-exist
{
"errors": [
{
"message": "You don't have permission to access this.",
"extensions": {
"code": "FORBIDDEN"
}
}
]
}
Impact:
The difference in errors between non-existent collections and collections blocked by permissions leak the existence of a collection to a user which is not authorized to access this object.
Credit:
Sebastian Krause - Hackmanit GmbH
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.13.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "32.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64749"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-13T23:07:31Z",
"nvd_published_at": "2025-11-13T22:15:52Z",
"severity": "MODERATE"
},
"details": "### Summary:\n\nAn observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases:\n1. A user tries to access an existing collection which they are not authorized to access.\n2. A user tries to access a non-existing collection.\n\nThe two differing error messages leak the existence of collections to users which are not authorized to access these collections.\n\n### Details:\n\nThe following response returns an error message, when requesting a collection the user is not authorized to access.\n\n```\nGET /items/no-access\n{\n \"errors\": [\n {\n \"message\": \"You don\u0027t have permission to access collection \\\"no-access\\\" or it does not exist. Queried in root.\",\n \"extensions\": {\n \"reason\": \"You don\u0027t have permission to access collection \\\"no-access\\\" or it does not exist. Queried in root.\",\n \"code\": \"FORBIDDEN\"\n }\n }\n ]\n}\n```\n\nThe following response returns a different error message when requesting a collection which does not exist.\n\n```\nGET /items/does-not-exist\n{\n \"errors\": [\n {\n \"message\": \"You don\u0027t have permission to access this.\",\n \"extensions\": {\n \"code\": \"FORBIDDEN\"\n }\n }\n ]\n}\n```\n\n### Impact:\n\nThe difference in errors between non-existent collections and collections blocked by permissions leak the existence of a collection to a user which is not authorized to access this object.\n\n### Credit:\n\nSebastian Krause - [Hackmanit GmbH](https://hackmanit.de)",
"id": "GHSA-cph6-524f-3hgr",
"modified": "2025-11-15T03:15:40Z",
"published": "2025-11-13T23:07:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64749"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Directus Vulnerable to Information Leakage in Existing Collections"
}
GHSA-CPVX-2365-466C
Vulnerability from github – Published: 2023-09-06 15:30 – Updated: 2023-09-08 12:18By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-superset"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-39264"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-08T12:18:38Z",
"nvd_published_at": "2023-09-06T13:15:08Z",
"severity": "MODERATE"
},
"details": "By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users.\u00a0This vulnerability exists in Apache Superset versions up to and including 2.1.0.",
"id": "GHSA-cpvx-2365-466c",
"modified": "2023-09-08T12:18:38Z",
"published": "2023-09-06T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39264"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/superset"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Superset may expose internal traces on REST API endpoints"
}
GHSA-CPXH-JWHH-M496
Vulnerability from github – Published: 2024-10-31 21:31 – Updated: 2024-11-01 18:31An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the server.
{
"affected": [],
"aliases": [
"CVE-2024-39719"
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-31T20:15:04Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the \"File does not exist\" error message to the attacker, providing a primitive for file existence on the server.",
"id": "GHSA-cpxh-jwhh-m496",
"modified": "2024-11-01T18:31:32Z",
"published": "2024-10-31T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39719"
},
{
"type": "WEB",
"url": "https://oligosecurity.webflow.io/blog/more-models-more-probllms"
},
{
"type": "WEB",
"url": "https://www.oligo.security/blog/more-models-more-probllms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Mitigation
Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Mitigation MIT-33
Strategy: Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Mitigation MIT-40
Strategy: Compilation or Build Hardening
Debugging information should not make its way into a production release.
Mitigation MIT-40
Strategy: Environment Hardening
Debugging information should not make its way into a production release.
Mitigation
Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Mitigation
Create default error pages or messages that do not leak any information.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-54: Query System for Information
An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.
CAPEC-7: Blind SQL Injection
Blind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection is a form of SQL Injection that overcomes the lack of error messages. Without the error messages that facilitate SQL Injection, the adversary constructs input strings that probe the target through simple Boolean SQL expressions. The adversary can determine if the syntax and structure of the injection was successful based on whether the query was executed or not. Applied iteratively, the adversary determines how and where the target is vulnerable to SQL Injection.