CWE-221
Information Loss or Omission
2006-07-19
00h00 +00:00
00h00 +00:00
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
이름: Information Loss or Omission
The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
일반 정보
취약점 도입 방식
Architecture and DesignImplementation
Operation
적용 가능한 플랫폼
언어
클래스: Not Language-Specific (Undetermined)기술
클래스: Not Technology-Specific (Undetermined)일반적인 결과
| 범위 | 영향 | 가능성 |
|---|---|---|
| Non-Repudiation | Hide Activities |
관찰된 예시
| 참고 자료 | 설명 |
|---|---|
CVE-2004-2227 | Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions. |
CVE-2003-0412 | application server does not log complete URI of a long request (truncation). |
CVE-1999-1029 | Login attempts are not recorded if the user disconnects before the maximum number of tries. |
CVE-2002-0725 | Chain: File system allows local attackers to hide file usage activities via a hard link (CWE-65) to the target file, which causes the link to be recorded in the audit trail instead of the target file (CWE-221). |
CVE-1999-1055 | Product does not warn user when document contains certain dangerous functions or macros. |
취약점 매핑 메모
근거 : This CWE entry is a Class and might have Base-level children that would be more appropriate댓글 : Examine children of this entry to see if there is a better fit
관련 공격 패턴
| CAPEC ID | 공격 패턴 이름 |
|---|---|
| CAPEC-81 | Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application. |
제출
| 이름 | 조직 | 날짜 | 출시일 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Description, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships |
