CWE-209 通过错误消息导致的信息暴露 类弱点 395 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-209属于信息泄露漏洞，指软件在生成错误消息时意外包含敏感的环境、用户或数据信息。攻击者通常利用这些详细的错误堆栈或路径信息，识别系统架构、数据库结构或用户身份，从而辅助后续更精准的定向攻击。开发者应避免在生产环境中暴露内部细节，通过配置统一的通用错误页面、过滤敏感字段及记录日志而非直接展示，来防止敏感数据外泄。
try { /.../ } catch (Exception e) { System.out.println(e); }try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-26272 | IBM Security Guardium Data Encryption 安全漏洞 — Guardium Cloud Key Manager | 5.3 | Medium | 2023-08-28 |
| CVE-2023-32755 | e-Excellence U-Office Force 安全漏洞 — U-Office Force | 5.3 | Medium | 2023-08-25 |
| CVE-2023-40171 | Netflix Dispatch 安全漏洞 — dispatch | 9.1 | Critical | 2023-08-17 |
| CVE-2023-35009 | IBM Cognos Analytics 安全漏洞 — Cognos Analytics | 5.3 | Medium | 2023-08-16 |
| CVE-2023-1210 | GitLab 信息泄露漏洞 — GitLab | 3.1 | Low | 2023-08-01 |
| CVE-2023-31429 | Brocade Fabric OS 命令注入漏洞 — Fabric OS | 5.5 | Medium | 2023-08-01 |
| CVE-2020-4868 | IBM TRIRIGA Application Platform 安全漏洞 — TRIRIGA Application Platform | 4.3 | Medium | 2023-07-31 |
| CVE-2023-3362 | GitLab 授权问题漏洞 — GitLab | 5.3 | Medium | 2023-07-13 |
| CVE-2023-37260 | oauth2-server 安全漏洞 — oauth2-server | 8.2 | High | 2023-07-06 |
| CVE-2023-34110 | Flask-AppBuilder 安全漏洞 — Flask-AppBuilder | 2.7 | Low | 2023-06-22 |
| CVE-2023-34339 | JetBrains Ktor framework 安全漏洞 — Ktor | 3.3 | Low | 2023-06-01 |
| CVE-2023-33181 | Xibo 安全漏洞 — xibo-cms | 4.3 | Medium | 2023-05-30 |
| CVE-2023-28514 | IBM MQ 安全漏洞 — MQ | 6.2 | Medium | 2023-05-19 |
| CVE-2023-27860 | IBM Maximo Asset Management 安全漏洞 — Maximo Asset Management | 5.3 | Medium | 2023-04-27 |
| CVE-2023-29193 | SpiceDB 安全漏洞 — spicedb | 8.7 | High | 2023-04-14 |
| CVE-2022-4770 | Hitachi Vantara Pentaho Business Analytics Server 安全漏洞 — Pentaho Business Analytics Server | 4.3 | Medium | 2023-04-03 |
| CVE-2022-4769 | Hitachi Vantara Pentaho Business Analytics Server 安全漏洞 — Pentaho Business Analytics Server | 4.3 | Medium | 2023-04-03 |
| CVE-2023-25687 | IBM Security Guardium 日志信息泄露漏洞 — Security Key Lifecycle Manager | 4.3 | Medium | 2023-03-21 |
| CVE-2023-25695 | Apache Airflow 安全漏洞 — Apache Airflow | 5.3 | - | 2023-03-15 |
| CVE-2023-27587 | ReadtoMyShoe 安全漏洞 — readtomyshoe | 7.4 | High | 2023-03-13 |
| CVE-2023-26052 | Saleor 安全漏洞 — saleor | 3.7 | Low | 2023-03-02 |
| CVE-2023-26051 | Github saleor 安全漏洞 — saleor | 6.5 | Medium | 2023-03-02 |
| CVE-2020-5026 | IBM Financial Transaction Manager 安全漏洞 — Financial Transaction Manager | 4.3 | Medium | 2023-03-01 |
| CVE-2023-25956 | Apache Airflow 安全漏洞 — Apache Airflow AWS Provider | 5.3 | - | 2023-02-24 |
| CVE-2023-0655 | SonicWall Email 安全漏洞 — SonicWall Email Security | 5.3 | - | 2023-02-14 |
| CVE-2022-46675 | Dell Wyse Management Suite 安全漏洞 — Wyse Management Suite | 5.3 | Medium | 2023-02-10 |
| CVE-2015-10012 | FrameworkUserBundle 安全漏洞 — FrameworkUserBundle | 3.5 | Low | 2023-01-03 |
| CVE-2022-22449 | IBM Security Verify Governance 安全漏洞 — Security Verify Governance, Identity Manager | 5.3 | Medium | 2022-12-22 |
| CVE-2022-39304 | ghinstallation 安全漏洞 — ghinstallation | 5.0 | Medium | 2022-12-20 |
| CVE-2022-34881 | Hitachi JP1/Automatic Operation 安全漏洞 — JP1/Automatic Operation | 3.3 | Low | 2022-12-06 |
CWE-209（通过错误消息导致的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 395 条 CVE 漏洞。