Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display the stack trace. That is an obvious vulnerability.)

Is it a vulnerability to display exception messages in an error page?

For maximum security, what should we display in an error page? What should we not display?

Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display the stack trace. That is an obvious vulnerability.)

Is it a vulnerability to display exception messages in an error page?

For maximum security, what should we display in an error page? What should we not display?

EDIT: My hunch is that it is a vulnerability, but I want to hear an expert opinion.