COMMON WEAKNESS ENUMERATIONDraft

CWE-544

Missing Standardized Error Handling Mechanism

The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.

Extended description

If the product handles error messages individually, on a one-by-one basis, this is likely to result in inconsistent error handling. The causes of errors may be lost. Also, detailed information about the causes of an error may be unintentionally returned to the user.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Risk

What does successful exploitation lead to?

Quality DegradationUnexpected StateVaries by Context

Affected security scopes: Integrity, Other

Defence

How is it prevented and fixed?

Architecture and Design

Architecture and design approach

Detail
define a strategy for handling errors of different severities, such as fatal errors versus basic log events. Use or create built-in language features, or an external package, that provides an easy-to-use API and define coding standards for the detection and handling of errors.