Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display the stack trace. That is an obvious vulnerability.)
Is it a vulnerability to display exception messages in an error page?
For maximum security, what should we display in an error page? What should we not display?
EDIT: My hunch is that it is a vulnerability, but I want to hear an expert opinion.