ExonautWeb 21.6 is affected by an information disclosure vulnerability due to overly verbose error messaging.

The application generates verbose error messages that provide excessive technical detail. This information can be leveraged by an attacker to gain insights into the underlying system architecture, facilitating further exploitation efforts.

While verbose error messages are often considered a lower-tier risk, they provide critical reconnaissance data for attackers to map the attack surface of the application. A CVSS score of 9.8 suggests that in this specific environment, the leaked information is highly sensitive, potentially exposing credentials, database structures, or internal file paths that could lead to full system compromise.

Immediate Action: Update to the latest version of ExonautWeb, which should include hardened error handling and suppressed technical details.

Proactive Monitoring: Review web server and application logs for unusual request patterns that might indicate an attacker is actively inducing errors to probe the system.

Compensating Controls: Configure the web server or application framework to return generic error messages to users while logging detailed errors internally to secure files.

Public Exploit Available: Unknown

The high CVSS score indicates that the information leaked through these error messages is critical. Administrators must apply available patches immediately and ensure that global error handling policies are configured to prevent information disclosure.