COMMON WEAKNESS ENUMERATIONDraft

CWE-600

Uncaught Exception in Servlet

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

Extended description

When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

Terminology

Alternate terms and usages

Missing Catch Block

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Read Application DataDoS: Crash, Exit, or Restart

Affected security scopes: Confidentiality, Availability

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
Implement Exception blocks to handle all types of Exceptions.