1. Home
  2. CWE Database
  3. CWE-756
Base · Medium

CWE-756: Missing Custom Error Page

The product does not return custom error pages to the user, possibly exposing sensitive information.

CWE-756 · Base Level ·1 CVEs

Description

The product does not return custom error pages to the user, possibly exposing sensitive information.

Potential Impact

Confidentiality

Read Application Data

Demonstrative Examples

In the snippet below, an unchecked runtime exception thrown from within the try block may cause the container to display its default error page (which may contain a full stack trace, among other things).
Bad
Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {try {...} catch (ApplicationSpecificException ase) {logger.error("Caught: " + ase.toString());}}
The mode attribute of the <customErrors> tag in the Web.config file defines whether custom or default error pages are used.
In the following insecure ASP.NET application setting, custom error message mode is turned off. An ASP.NET error message with detailed stack trace and platform versions will be returned.
Bad
<customErrors mode="Off" />
A more secure setting is to set the custom error message mode for remote users only. No defaultRedirect error page is specified. The local user on the web server will see a detailed stack trace. For remote users, an ASP.NET error message with the server customError configuration setting and the platform version will be returned.
Good
<customErrors mode="RemoteOnly" />
Another secure option is to set the mode attribute of the <customErrors> tag to use a custom page as follows:
Good
<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />

Real-World CVE Examples

CVE IDDescription
CVE-2023-27998analytics platform does not have a custom error page, allowing access to sensitive information

CWE-755: Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

CWE-209: Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated d...

Frequently Asked Questions

What is CWE-756?

CWE-756 (Missing Custom Error Page) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not return custom error pages to the user, possibly exposing sensitive information.

How can CWE-756 be exploited?

Attackers can exploit CWE-756 (Missing Custom Error Page) to read application data. This weakness is typically introduced during the Installation, System Configuration, Operation phase of software development.

How do I prevent CWE-756?

Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.

What is the severity of CWE-756?

CWE-756 is classified as a Base-level weakness (Medium abstraction). It has been observed in 1 real-world CVEs.