CWE-550
Server-generated Error Message Containing Sensitive Information
Certain conditions, such as network failure, will cause a server error message to be displayed.
CVE-2023-40726 (GCVE-0-2023-40726)
Vulnerability from cvelistv5
Published
2023-09-12 09:32
Modified
2025-02-27 20:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-550 - Server-generated Error Message Containing Sensitive Information
Summary
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive information about the server. This could allow an attacker to directly access the database.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Siemens | QMS Automotive |
Version: All versions < V12.39 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:38:51.168Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40726",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T21:51:52.522843Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T20:55:59.460Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "QMS Automotive",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V12.39"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The affected application server responds with sensitive information about the server. This could allow an attacker to directly access the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-550",
"description": "CWE-550: Server-generated Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-12T09:32:26.511Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2023-40726",
"datePublished": "2023-09-12T09:32:26.511Z",
"dateReserved": "2023-08-21T10:57:08.486Z",
"dateUpdated": "2025-02-27T20:55:59.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5617 (GCVE-0-2023-5617)
Vulnerability from cvelistv5
Published
2024-02-28 22:30
Modified
2024-08-29 14:47
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-550 - Server-generated Error Message Containing Sensitive Information
Summary
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hitachi Vantara | Pentaho Data Integration & Analytics |
Version: 1.0 Version: 9.4.0.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:32.308Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hitachi_vantara:pentaho_data_integration_\\\u0026_analytics:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pentaho_data_integration_\\\u0026_analytics",
"vendor": "hitachi_vantara",
"versions": [
{
"lessThan": "9.3.0.6",
"status": "affected",
"version": "1.0",
"versionType": "custom"
},
{
"lessThan": "10.1.0.0",
"status": "affected",
"version": "9.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-05T18:28:22.655674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-29T14:47:10.616Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pentaho Data Integration \u0026 Analytics",
"vendor": "Hitachi Vantara",
"versions": [
{
"lessThan": "9.3.0.6",
"status": "affected",
"version": "1.0",
"versionType": "maven"
},
{
"lessThan": "10.1.0.0",
"status": "affected",
"version": "9.4.0.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Hitachi Group Member"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eHitachi Vantara Pentaho Data Integration \u0026amp; Analytics versions before 10.1.0.0 and 9.3.0.6, including\u0026nbsp;\u003cspan style=\"background-color: var(--wht);\"\u003e9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.\u003c/span\u003e\u003c/p\u003e\n\n"
}
],
"value": "\nHitachi Vantara Pentaho Data Integration \u0026 Analytics versions before 10.1.0.0 and 9.3.0.6, including\u00a09.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.\n\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-170",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-170 Web Application Fingerprinting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-550",
"description": "CWE-550: Server-generated Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-28T22:30:40.128Z",
"orgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"shortName": "HITVAN"
},
"references": [
{
"url": "https://support.pentaho.com/hc/en-us/articles/24313358254861--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Server-generated-Error-Message-Containing-Sensitive-Information-Versions-before-10-1-0-0-and-9-3-0-6-including-all-versions-before-10-0-x-Impacted-CVE-2023-5617"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Hitachi Vantara Pentaho Data Integration \u0026 Analytics - Server-generated Error Message Containing Sensitive Information",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dce6e192-ff49-4263-9134-f0beccb9bc13",
"assignerShortName": "HITVAN",
"cveId": "CVE-2023-5617",
"datePublished": "2024-02-28T22:30:40.128Z",
"dateReserved": "2023-10-17T15:42:11.661Z",
"dateUpdated": "2024-08-29T14:47:10.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phases: Architecture and Design, System Configuration
Description:
- Recommendations include designing and adding consistent error handling mechanisms which are capable of handling any user input to your web application, providing meaningful detail to end-users, and preventing error messages that might provide information useful to an attacker from being displayed.
No CAPEC attack patterns related to this CWE.