Config files : Information leak

System configuration information leak is possible. This can help an attacker to create a plan of an attack.

Debug information and error messages can be written to the log, displayed to the console, or sent to the user depending on the system settings. In some cases, an attacker can make a conclusion about the system vulnerabilities from the error message. For example, a database error can indicate insecurity against SQL injection attacks. Information about the version of the operating system, server applications and system configurations can also be of value to the attacker.

This applies both to the classic web applications and mobile applications.