Stack traces are not vulnerabilities by themselves, but they often reveal information that is interesting to an attacker. Attackers attempt to generate these stack traces by tampering with the input to the web application with malformed HTTP requests and other input data.

If the application responds with stack traces that are not managed then it could reveal information useful to attackers. This information could then be used in further attacks. Providing debugging information as a result of operations that generate errors is considered a bad practice due to multiple reasons.

For example, it may contain information on internal workings of the application such as relative paths of the point where the application is installed or how objects are referenced internally.

Configure your application not to provide detailed error pages in production environments.

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N