CWE-221
Information Loss or Omission
2006-07-19
00h00 +00:00
00h00 +00:00
Benachrichtigungen für ein CWE
Bleiben Sie über alle Änderungen zu einem bestimmten CWE informiert.
Name: Information Loss or Omission
The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
Allgemeine Informationen
Einführungsmodi
Architecture and DesignImplementation
Operation
Anwendbare Plattformen
Sprache
Klasse: Not Language-Specific (Undetermined)Technologien
Klasse: Not Technology-Specific (Undetermined)Häufige Konsequenzen
| Bereich | Auswirkung | Wahrscheinlichkeit |
|---|---|---|
| Non-Repudiation | Hide Activities |
Beobachtete Beispiele
| Referenzen | Beschreibung |
|---|---|
CVE-2004-2227 | Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions. |
CVE-2003-0412 | application server does not log complete URI of a long request (truncation). |
CVE-1999-1029 | Login attempts are not recorded if the user disconnects before the maximum number of tries. |
CVE-2002-0725 | Chain: File system allows local attackers to hide file usage activities via a hard link (CWE-65) to the target file, which causes the link to be recorded in the audit trail instead of the target file (CWE-221). |
CVE-1999-1055 | Product does not warn user when document contains certain dangerous functions or macros. |
Hinweise zur Schwachstellen-Zuordnung
Begründung : This CWE entry is a Class and might have Base-level children that would be more appropriateKommentar : Examine children of this entry to see if there is a better fit
Verwandte Angriffsmuster
| CAPEC ID | Name des Angriffsmusters |
|---|---|
| CAPEC-81 | Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application. |
Einreichung
| Name | Organisation | Datum | Veröffentlichungsdatum | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
Änderungen
| Name | Organisation | Datum | Kommentar |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Description, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships |
