COMMON WEAKNESS ENUMERATIONDraft

CWE-600

Uncaught Exception in Servlet

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

Soyutlama

Variant

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

Genişletilmiş açıklama

When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

Terminoloji

Alternatif adlar ve kullanım biçimleri

Missing Catch Block

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Read Application DataDoS: Crash, Exit, or Restart

Etkilenen güvenlik alanları: Confidentiality, Availability

Savunma

Nasıl önlenir ve çözülür?

Implementation

Uygulama aşaması savunması

Detay
Implement Exception blocks to handle all types of Exceptions.